Alright! So, at the moment we're trying to figure out why the CRTC chip select (pin 25) is never getting activated (active LOW). We figured out that it is set by a 3-input NAND gate, which is fed by:
- UD15 pin 18 (BA7, i.e. bit 7 of the buffered address bus)
- UE14 pin 8 (labeled "x8xx", this goes HIGH whenever the selected address follows the pattern $x8xx)
- UE12 pin 16 (labeled "/(I/O)", this pin goes LOW whenever the selected address follows the pattern $Exxx).
- This signal is fed into the NAND gate through an inverter
All the above tells us that:
CRTC pin 25 = NOT ("BA7" AND "x8xx" AND "I/O")
i.e. we expect the CRTC to be selected when the address is in the range $E880 - $E8FF.
@daver2 has said that there should be a "chime" (i.e. some activity) on CRTC pin 25 shortly after a reset, but I've managed to confirm that this doesn't happen (setting the trigger to a CRTC chip select falling edge, and it never triggers).
I connected the oscilloscope to the three inputs that feed CRTC chip select, and discovered that there is actually lots of activity on all three of them after a reset. However, for some reason they never line up, meaning the CRTC never gets selected. Take a look at this:

The topmost signal is the CPU's SYNC pin, which I use as a sanity checker (and used as the trigger here).
There's a flurry of activity on BA7 straight after reset, then BA7 stays HIGH, x8xx stays LOW, and /(I/O) has a bunch of activity for just over 1ms.
I inspected the activity closely after this, but basically all the signals miss each other, never lining up to trigger the CRTC select.
Here's detail on the section at 1 grid square to the right of the centre on the above plot (each gridline is 200us):

The purple line through the middle is just a little helper from the scope, it computes the logical AND of BA7 and x8xx. They are never accessed at the same time (I searched outside of this view as well), so it's never accessing
anything in the range $x880 - $x8FF.
So... is this a problem with the ROMs, then? It's clearly churning away happily, but choosing never to send any data to the CRTC. Maybe somebody has modified the EPROMs with something else that never outputs to the screen? But I'd be very confused if someone did that intentionally. It's just strange that the computer does seem to be doing quite a bit of activity
without ever trying to put anything on the screen.
(Also, quick question: does the CRTC require chip select to go LOW for it to output HSYNC and VSYNC pulses? Because my CRTC is never outputting those pulses, but I don't know if that's a sign of a defective chip or just that it's never being
told to output anything.)
So, I'm not sure what the next step here is! What would your guidance be? I've done some snooping online, and it seems it is possible to wire up a Raspberry Pi to program EPROMs, so let's assume I do have the capability to do that (even though it may take a bit of effort to set up, but that's mostly a software problem, and software is my day job!)