However, given that the secondary current is zero (open-circuit), the
∮H⋅dℓ=Is equation cannot be valid. This seems to be a paradox - what
am I missing here?
Amperes law states that the integrated magnetic field is related to an electric current.
In the definition the line integral must be closed, when you open the circuit and no current flows, you violate this integral. It is no longer a closed line integral and you can't use it to preform integration and the math breaks down. The current loop needs to be a closed loop. A lot of people just simplify the line integral, but if you wanted to preform a true integration, you would follow the wire out around the load and back in your line integral, since this is negligible compared with the current generated through the secondary people often leave it out.
I presume this flux flows around the core, therefore there is flux
through the secondary winding - so why is there no current?
The loop is broken, current has have conductance to flow (vacuum and air make poor conductors). However, a voltage is still generated across the secondary, the electrons are being pushed up "against the wall" of the broken conductor, ready to flow if you decided to put a load on the secondary.