Per the documentation (see Transit Routing with a Single L3Out Profile under Guidelines for Transit Routing), with the VRF enforced and without using contracts under the 0.0.0.0/0 subnet I just need to check Import Route Control Subnet and use 0.0.0.0/1 and 128.0.0.0/1 with External Subnets for the External EPG checked.
However, in order to get this to work on the 0.0.0.0/0 subnet I also have to check Export Route Control Subnet and Aggregate Export. (I realize I don't need External Subnets for the External EPG, either.)
It works, but it doesn't match the documentation so I'm a little confused. I'll add that the other two scenarios in the documentation (unenforced VRF and a single 0.0.0.0/0 subnet and vzAny contract with a single 0.0.0.0/0 subnet) work more or less as expected.
This is ACI 4.0(1h). The L3out config is attached; this is a lab scenario, so I'm not concerned about giving up IP information.
