Dear Nick,
Haven't heard back yet from condor, I found in previous posts and condor docs that this might have to do with the condor UID_DOMAIN config variable, which is set to $(FULL_HOSTNAME) in my case, as recommended therein. Also, "condor_master" is being run as root.
Which user does condor believe you to be?
The user running the "condor_submit" command is "galaxy", which has permissions to write that output file. But I don't know if this is the relevant uid or if condor is trying to open that file as a different user within the condor_submit command.
Oren