I figured this one out. I had loaded an XmlBeans bundle from the Spring OSGi bundle repository, and it didn't have an import for the javax.xml.namespace in the Manifest. So it was that bundle trying to load javax.xml.namespace.QName, not my application bundle.
I think the Spring bundle was probably tested in an OSGi container that included the built-in Java 1.5/1.6 javax.xml.namespace package by default (which SMX doesn't - it substitutes an Apache version). So that's why it worked for whoever built it. I guess substituting for JDK packages still has its gotchas, even in an OSGi world!
I'm pretty new to OSGi, but it seems like there are quite a few class loading details to be aware of. One thing that would be beneficial is for class loading error messages to print out a bit of information about the bundle that is trying to load the class. That would have been a timesaver in this case since I got faked out and thought it was my App bundle having the problem.