This article was originally about automatic updates over SSH2 not working for me when I upgraded to WordPress 2.8. WordPress 2.9 is out now, and this problem turned out not to be their fault.
After filing a bug report and working through it with the WordPress team, a solution was eventually found (see the final update to this post). If you're not inclined to skip to the end then here is a spoiler: turn off open_basedir or make the declaration less restrictive.
If you're not experiencing this problem (and Google says you're landing here if you're looking for help setting up SFTP/SSH updating for WordPress), I don't think this write-up will be of much help. But feel free to stick around; I've got snacks!