I had some issues on Zone Director with the country code of the APs not matching the country-code on the ZD. Haven't seen this yet on SZ but are your APs a US Part Number by any chance (and your SZ configured for non-US devices?) Its a long-shot and I know you mention that you don't see the SSH tunnel established.. but just checking.
If you can mirror traffic on the switch hosting the AP, do you see it trying to initiate ANY connection to SZ?