I ended up setting the root page to require authentication. All subpages inherit the authentication setting. Once set, I made the site live.
So now, rather than seeing an offline message, unauthenticated users see a login screen. Once logged in, I can browse the site using the live settings, which includes caching.
When the site's ready for prime time, I can just remove the authentication requirement.