In the process of trying to resolve the infection, I kept hitting major, dangerous hurdles. I had a pretty good guess as to what had led to the infection, but hit hurdle after hurdle as I tried to act accordingly. I was surprised that the simple steps I tried didn't work.
Specifically, this is what was happening and what made it malware:
Ads are popping up over other apps and my LG's home screen since I installed this app yesterday. Free VPN Master is the only new app I had installed (on my LG) in over 2 weeks (according to Lookout AND my recollection). It violates Google Policies: Disruptive ads. Violates: "Ads must only be displayed within the app serving them."
The only other possibly significant change I made was to enable - but not use - developer mode.
This app doesn't seem to have the permissions to enable it to put up the ads I'm seeing, but it's the only thing that makes sense, and the whole VPN Master brand does have an awful reputation. Also, lumendatabase notice #15425531 is notable.