Ok. Problem fixed. I realized a step I was forgetting.
Permissions on public_html itself are 750 and username:nobody.
I went through and changed permissions. That at least resolved the 500 error. Now to go back to resolving my original problem with the upgrade.
They do have read permissions. They’re -rw-r–r– with root as owner. No different than any other of our sites.