Just to conclude this:
I separated my br.lan into two new devices using VLAN filtering. I then switched my main "lan" interface onto one of those, leaving the other to be used with my second ISP as "lan-new". While doing this I also took the opportunity to extend those across my switches with trunks etc.
Back on the router I got IPv4 working really easily, with private subnets assigned to each VLAN instance, and OpenWRT managing routing between them. All outbound IPv4 traffic went with my default route, which followed the IPv4 priority, and out onto my default (original) ISP as expected.
I then installed the PBR app, which allowed me to create a simple rule for the IPv4 traffic (so that anything from the "lan-new" subnet not destined for a private IP address range goes with my non-default ISP) and that was it for IPv4. Done and working.
IPv6 was more problematic, and although I have a working solution now, I'm not sure why I needed to do it the way I did. Bottom line is I followed @patrakov approach with prefix filters on the interfaces, which appeared to cause prefixes to be selectively assigned correctly, and dhcp6 and RA to configure addresses etc.
But, routing didn't work. From within lan-new I couldn't reach any IPv6 addresses outside, and from outside I couldn't access any IPv6 address within lan-new, despite both being in the same firewall zone. That was equally true for ULA or GUA addresses.
In the end, after a lot of fighting, since I only intend this new subnet to be used by one or two machines, I tried manually creating an absolutely minimal static netplan config on my test ubuntu machine:
network:
version: 2
renderer: networkd
ethernets:
eth0:
optional: true
accept-ra: no
addresses:
- 192.168.251.212/24
- "2001:xxx:xxxx:xx00::212/64"
- "fdb4:0:0:1::212/64"
gateway4: 192.168.251.1
gateway6: "2001:xxx:xxxx:xx00::1"
nameservers:
search: [my.lan]
addresses:
- 192.168.251.1
- "2001:xxx:xxxx:xx00::1"
- "fdb4:0:0:1::1"
I added a couple of DNS records for 192.168.251.212 and fdb4:0:0:1::212 to OpenWRT for convenience, and everything works perfectly.
So I suspect somewhere in the morass of IPv6 settings to automatically configure DHCP6 RA NDP etc etc, I misconfigured something. I'd love to understand what, and if anyone can point me to a good guide for setting up multiple routable IPv6 subnets on a recent version of OpenWRT, I'd be delighted to read and understand.
But for me, this now works well enough for my immediate needs. Hope this might help someone else.