Figured it out.

The Expires header ("Sun, 3 Mar 2013 13:28:24 GMT") is using a single digit for the date. If I change the "3" to "03", Nginx works as expected. RFC 1123 and RFC 822 say that both one- and two-digit numbers are valid, so this is a bug in Nginx's caching. I'll report it to the bug tracker.