Huge thanks to Chris Hoffman of www.makeuseof.com for a great article (here). As a mid-level but not hardcore geek, I agonized over what approach to take. I finally decided to go with Thunderbird, as Chris described. Very happy, not much pain, 90 minutes later I have my 10-year-old, 7 Gb Gmail account backed up. THANK YOU, CHRIS. I actually spent more time researching and agonizing, than I did configuring--even with a couple of minor Murphy's Law incidents.
A couple of updates to Chris's article:
1. Biggest thing--if you have Gmail 2-step authentication, you will have to generate an application-specific password. Obvious to some, but not me--I only realized in a "duh" moment when I searched for help.
2. In the new version of Thunderbird, I didn't have to do any of that boolean preferences stuff. It all just worked. But took me a while to give up looking where I could set them, and try my luck. What a pleasant surprise.
3. Avast had SSL conflicts. I wound up turning off Mail monitoring. Will go back to it eventually and see if I can make it happy.
In the meantime--thanks again to Chris and makeusof.com!
Next stops for me: Google Takeout, and a 1 Tb external drive.