Somebody wrote me back with the following observation:
One of the things I've learned is never report things like that to HR. Report them to the police.
The job of HR is not to help you, the employee. It is to protect the company. The more credible your complaints to HR look, especially if there was some negligence in your management chain, the more they will try to damage your story or credibility. That's their job.
Wow. This is unquestionably a reasonable worry. And I've never heard that conflict of interest brought up by HR. Which means it is very, very likely to be true. And I'd simply never thought of that.
I think this is advice I'm going to give more often, starting with posting it here. I'm not sure whether to give the advice "report it to HR *and* the police." But then, if he's right and HR will try to damage your credibility if you have a credible complaint, then that's the worst thing you can do. Because fundamentally, they can do that if they have time to gather resources.
I'm conflicted on that, too, since it requires the HR folk in question to be somewhere between "fairly mercenary" and "evil." So the answer is probably "that's only sometimes true."