Is MIXED_DML_OPERATION in unit tests broken?

Likely not a bug. Note from the documentation on sObjects That Cannot Be Used Together in DML Operations:

You can insert a user in a transaction with other sObjects in Apex code saved using Salesforce API version 15.0 and later if UserRoleId is specified as null.

Your unit test does not filter on this field, nor clear it out before inserting the clone.

If you are going to create a User record by cloning the running user, make sure to set UserRoleId = null before your insert call.

If you do not do so, test runs will not behave the same for each user who runs them, or if certain attributes on that user change.

Working with support, the root cause was uncovered. They're working with R&D, but I don't have a bug number at the time of this answer.

The root cause was that the System Administrator profile had been enabled for Lightning Sync. This causes erroneous test failures if you follow this advice:

You can insert a user in a transaction with other sObjects in Apex code saved using Salesforce API version 15.0 and later if UserRoleId is specified as null.

In our code, we have a number of tests that were using this technique, and they were all failing when ran directly, but not when deploying (change sets or API).

For now, we've disabled Lightning Sync for the System Administrator profile, and we have a backlog item to update these unit tests to use System.runAs in the future.