More info:
Wordfence has detected issues in the partial scans that have in fact run. I resolved some by deleting unused themes and plugins, ignoring some known theme changes (yeah, I didn't modify them in the proper way myself). I also deleted two suspicious files.
But as far as I can tell the Pharma Hack also involves database entries, and I haven't seen anything about cleaning those in any Wordfence scanning so far.
I have also looked through documentation about using Google's Webmaster tools, and while under Security it says "Currently, we haven't detected any security issues with your site's content" it does seem like some pages still contain Pharma Hack junk when fetched in the right way.
...and I'm now at the limit of my understanding of what to do and how to do it.