I take that back. I've determined that there's so much noise between Vdd and Vss alone on the solderless breadboard that attempts to measure small signals accurately is extremely difficult. This despite a generous helping of bypass capacitors ranging from 0.1uF ceramics and 10uF tantalums to 200uF electrolytics. What seems to work best is using the oscilloscope in difference mode to measure the voltage across a single resistor. This seems to null out most of the Vdd fluctuations.
Eventually I moved R4 so it sat between Q4 and Q5 and measured the voltage across it. What I see is less than 2mA (200mV across 100 ohms) through that resistor during the low-to-high output transitions, and essentially nothing during the high-to-low transitions, regardless of which FET I use for Q4. That kinda kills shoot-through current a culprit.
To try to figure out where the current is going I modified the test circuit to put R4 in series with the gate of Q4. To minimize differences between my test circuit and the actual push-pull driver I reconnected the drain of Q4 to Vdd, and the source of Q5 to Vss.
First let's look at the screen caps with a BSS83 as Q4. The pink "B" trace is the difference between the blue and green traces, and is displayed at 200mV/div or 2mA/div.
Now let's look at the same setup with a DMN26 as Q4.
How about the FDV301? Here it is, using the same scales.
At first I assumed the problem was the single Zener static protection diode becoming forward-biased. If I put a resistor in series with the gate of Q5, whose source is grounded, I shouldn't see this sort of spike. Right? Of course. Let's try it anyway.
Now what do I do with the push-pull drivers? I don't know. I've disproven the shoot-through hypothesis, and it seems unlikely that this is the protection diode conducting. Do I need to do anything else? Do I even care about this behavior?
I think I need to think about this a while longer.