After confirming with Heroku support, this does indeed appear to be a bit of a catch-22.
The solution was to put collectstatic in the Dockerfile so that it runs during build time and the files persist.
We got around not having a secret key config var by setting a default secret key using the get_random_secret_key function from Django.
The run phase uses the secret key from the Heroku config vars, so we aren’t actually changing the secret key every time — the default only applies to the build process. collectstatic doesn’t index on the secret key, so this is fine.
In settings.py
from django.core.management.utils import get_random_secret_key
...
SECRET_KEY = os.getenv('DJANGO_SECRET_KEY', default=get_random_secret_key())