Problem appears to have been a newbie-to-Composer issue. Every time I ran various composer commands, I'm told it overwrites the .json files I've been furiously editing for four hours, putting back all the code I'm trying to kill? Charming. Had no idea.
Was also told that the way to do this is to fork the project and point my top-level composer.json at it instead, then edit in the repo. That, however, requires learning eight skills I don't have yet—so I put in a quick-and-dirty hack: deleting the repositories lines from the top-level composer.json. That disconnected my local structure from the repo, and when I killed civicrm/civicrm-cxm-rpc again and required the google/apiclient that needed a newer phpseclib, it installed without a quibble.
Would still like to hear if axing civicrm-cxm-rpc has wider effects than I'm inferring from the docs.
EDIT TO ADD: Installing Open Social over the composer package of Drupal 8/CiviCRM died screaming in ways I didn't understand, so I'm now trying the reverse: using the distro of Drupal 8 and Open Social and patching it with CiviCRM, since dsnopek has a composer script that does only that.
This is running into several conflicts, and this time I am forking in github, because the above hack didn't work the second time through.
