Thanks everyone for your tips.
I played around a little bit with the fan directions and found the optimal was having the Noctua 37mm fan in the default position - pushing air towards the CPU through the heatsink. In the end, I didn't need undervolting - I changed desk locations and was amazed in the difference between temps. I thought airflow at my old desk was fine - it was basically a small nook made of veneered wood - like a recess in a wall that I was using as a stop-gap workspace.
I've since upgraded to a standalone workspace against a wall in the room - CPU temps are now peaking at about 80C, idling around 50-60. Even the M2 has improved - it's now idling around 50C under regular operating load (I run my OS from the M2) with the ASIC controller ('drive temperature 2') idling around 65C, peaking around 75C - but I gather this is normal. I checked the heatsink on it - it was properly installed and thermal performance was better with it on than off. But there is something weird about using foam as a heatsink; it's pretty counter-intuitive.
The current setup now has the PC on a desk against a wall - so only below and behind the case have surfaces. Before, it was blocked on three sides - picture it being placed in the corner of a hollow cube - and even the unblocked sides didn't have very much natural airflow.
So, yeah, lesson learned - SFF PCs really need suitable airflow, particularly if you're trying to run even slightly beefy components. And that airflow isn't just inside the case, but also the surrounding environment. That's turned out to matter much more than the ambient temp. Problem solved. Thanks everyone for your input.
