I was having trouble getting my stepper to turn properly so I connected 4 LEDs and series resistors to M3 and M4 so I could see in which order the pins were getting powered. That quickly explained why my servo would not turn properly. M4B (M4 pin next to GND) is always high, even when all pins are powered down with 'release()'.
As the pins get cycled when the stepper is being driven by the example program it also remains powered even as the other pins blink on/off in sequence. Using my DVM I can tell that pin 6 on the 595 is always high. Surprisingly this is M3B which is indeed how it's wired to the L293D pin 6 (2Y) which powers M3B. Looking at the image of the PCB it's clear this pin really is wired to M4. Odd.
Naturally the naming of pins is arbitrary and has nothing to do with the odd behavior of my shield but still this was quite confusing when I was trying to debug things. My shield is a couple of years old but it seems this design hasn't changed.
Anyway. My current thinking is that the 595 is broken. I did zap an L293D a while back so perhaps the 595 got a knock on the head as well. Unfortunately it's not socketed so it'll be interesting to desolder and replace it.
I suppose I could move my project to M1/M2 and see if those ports still work.
I guess there really isn't a question here, the debugging has been done. Comments about the apparent M3 and M4 mixup appreciated.