but based on what I read in GitHub, it sounds like if an admin denies a signup, the email doesn’t get sent, and then the user is in a weird locked state where they can’t signup again, and the admins can’t modify the user.

more or less yeah. by lemmy’s current design, if we deny you you’d never know unless we manually scraped your email and manually sent you a denial email, and emails aren’t mandatory so for some people that’s not even a hypothetical option