Check that the process startup time of dnsmasq is indeed after your restart. If that’s the case, then chances are that your container’s dhclient isn’t sending the right hostname somehow.
Brainfart! Turns out the --conf-file parameter was not being passed to dnsmasq inside the lxc-net script, because I set the variable in the wrong location! So of course my changes to dnsmasq.conf had no effect.
Setting fixed IPs works fine now by hostname or MAC.
I also learned that you can use dhcp-host=<host>:ignore if to exempt specific containers, neat!
p.s. Found a typo in the process. That should read LXC_DHCP…