This command that i would have expected to delete the subkey only actually deletes the primary secret key as well:
gpg --delete-secret-key "0x${SUBKEY_FPR}!"
yikes! It does give you a prompt with the primary fingerprint to confirm that you're willing to delete the whole thing, but unless you directly compare fingerprints, it's not obvious that it's prompting you to do something significantly more than you asked it to do.
afaict, the only supported way to delete a secret subkey without deleting its primary key is to learn its keygrip and do:
gpg-connect-agent "delete_key $KEYGRIP" /bye
This is definitely not intuitive for folks used to operating gpg from the command line.