I added

  masquerade=1

  mapprivate=1

  validateattrs=20

to venus.conf, and now venus works once it awakens at startup.
venus.conf.ex is not at all clear about what is the default and what
yisn't.  There are only 5 non-empty non-comment lines:

  rootservers=testserver.coda.cs.cmu.edu
  cacheblocks=100000
  mapprivate=1
  masquerade=1
  masquerade_port=0

(plus a few lines with only spurious whitespace).

So presumably this was a failure to masquerade and subsequent IPsec
trouble.  It would be nice if venus.conf.ex was consistent about
having only commented out directives, if all of them had the default
value, andif this were clearly explained at the top.  Since Coda lacks
man pages (well, when you build and install it from source, they
aren't there, so I consider them lacking) this file is really also
servting as 'venus.conf(5)'.  I could make a patch, but I don't know
the default values of mapprivate and masquerade.  But here's text for
the top:

# venus.conf.ex contains an entry for each configuration statement
# allowed in venus.conf.  Each statement is explained, and is then
# presented, commented out, with its default value.  Thus, if this
# file is used as venus.conf, the behavior of venus will be the same
# as with no config file.  Further, uncommenting any of these
# statements in a venus.conf should have no effect.  It is suggested
# that a venus.conf be created if needed, and that it contain only
# statements that differ from default values.



Venus hanging on startup until kicked remains a mystery, but I found
that 'vutil cs' would wake it up.