Is a referenced Create a reasonable client-to-server submission at all, or should publishing an existing object stay out of band?

I think this is a reasonable submission, although a different activity might be preferable. In one of my FEPs I proposed a Notify activity with similar semantics: it notifies recipients about the object. Something between Create and Announce.

Is rejecting request-side addressing right, or does someone have a case for merging it?

This sounds like an implementation detail. Generic servers may allow an invalid activity as long as it doesn't impersonate another local actor. Non-generic servers may need to have stricter validation procedures.