I have WPA-Enterprise working, finally!  This is a pretty ugly setup, so it works and auto-starts, but it's not pretty.  Use at your own risk.

The basic process requires upgrading wpa_supplicant to a later version, and then configuring it so that it grabs the configured username and password from the configuration file and correctly gets an address from DHCP.  Here's a brief setup.

1. Update system libraries.  The version of Raspbian on the LiveSectional image is old enough that it's no longer actively maintained.  To get the old packages we need, it's necessary to switch to the legacy mirror for buster libraries.  In /etc/apt/sources.list, add the legacy mirror by adding this line to the bottom of the file.  (There's some small risk here because the repos added cryptographic auth in later versions, but I'm doing this in a hacky proof-of-concept way.)

deb  http://legacy.raspbian.org/raspbian/  buster main contrib non-free rpi

Once you've added the legacy repo, update the package list, and then install some supporting libraries:

$ sudo apt update
$ sudo apt install libnl-3-dev
$ sudo apt install libnl-genl-3-dev
$ sudo apt install libdbus-1-dev
$ sudo apt install libnl-route-3-dev

These libraries are needed to build wpa_supplicant from source, and because they're dynamically linked, they need to be available at runtime.

2.  Update wpa_supplicant.  The underlying version of Raspbian that LiveSectional is based on contains a development version of 2.8 from 2019 (plus some patches), which seems to have a bug in the key negotiation.  I updated this to version 2.11, found here: https://w1.fi/wpa_supplicant/

Basically, get the source code, run make, and wait a long time since the Pi Zero is slow.  Go get your coffee.  To install the new version, I copied the compiled versions over the distribution version:

$ cd /sbin
$ sudo cp wpa_supplicant wpa_supplicant-dist
$ sudo cp wpa_cli wpa_cli-dist
$ sudo cp ~/wpa_supplicant-2.11/wpa_supplicant/wpa_supplicant wpa_supplicant-2.11
$ sudo cp ~/wpa_supplicant-2.11/wpa_supplicant/wpa_cli-2.11j
$ sudo cp wpa_supplicant-2.11 wpa_supplicant
$ sudo cp wpa_cli-2.11 wpa_cli

3. Configure wpa_supplicant.  To configure for your username and password, edit /etc/wpa_supplicant/wpa_supplicant.conf with your network information.  You should add certificates to validate your RADIUS server here, but that's another step I'm still working on.  If you don't add certificates, the Pi will accept any RADIUS server.

network={
        ssid="YOUR_SSID_NAME"
        key_mgmt=WPA-EAP
        pairwise=CCMP
        eap=PEAP
        identity="YOUR_USERNAME"
        password="YOUR_PASSWORD"
}

4. Configure system networking.  In /etc/network/interfaces, tell the system that wlan0 is a hotplug interface created when the driver loads, and that you should configure it with DHCP, and point it at the supplicant configuration file:

allow-hotplug wlan0
auto wlan0
iface wlan0 inet dhcp
    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

In /etc/wpa_supplicant/functions.sh, add a -c to the configuration file option in the command line so it's actually processed.  (There might be an elegant way to do this, but I am not sure what it is.)

Find the line that reads like this:

wpa_msg verbose "$WPA_SUP_BIN $WPA_SUP_OPTIONS $WPA_SUP_CONF"

Then add a -c for the supplicant configuration file variable, WPA_SUP_CONF:

wpa_msg verbose "$WPA_SUP_BIN $WPA_SUP_OPTIONS -c $WPA_SUP_CONF"