We found that masterfiles-stage.sh was not getting triggered on the policy hubs because the cfengine_internal_masterfiles_stage class was not being defined.
def.json was specifying the class like this:
The expectation was that hosts having the policy_server class would also define cfengine_internal_masterfiles_stage in order to trigger automatic policy deployments from the configured upstream repository.
Other hard classes like those defined for the hostname, public key, time, or system flavor already work. So the current work-around is to use one of those other classes instead. Specifically for this case we simply used any since the policy itself guards to policy_server.