You have pointed me to something, it is not quite all there yet but it's much less puzzling,

"I'll be back!"
woohoo, opensource at it's best

Well I have managed to get the workflow to work, after a fashion.
Two rules:

workflow
Update order status on full payment
Invoked on event: A payment gets entered for an order
condition: check order balance <= 0
action: update order status to complete
(action: Log to watchdog)

Checkout complete
Invoked on event: Customer completes checkout
condition: Order status Completed
action: Add user role
(action: Log to watchdog)

The role is set for the user (by function workflow_ng_action_user_addrole() in workflow_ng_user.inc ), but not the expiration stuff that gets done when I do it manually
This appears to be because the uc_roles module is invoked when the CC is manually charged, but not when set to do so automatically. This anomaly probably lies in payment.module, but I'm not sure yet.

More later.