Well, I can now answer my own question, which is always best. The
Java VM in a browser may or may not honor the client  CLASSPATH.
Apparently the MS JIT java  VM does, and the Sun 1.4.2 plug-in does
not. The latter can be manipulated by using a -classpath <dir>
option in the runtime parameters of the Java Plug-in Control Panel.
However, 1.4.2 does not appear to recognize that the applet  is local
to the client and therefore safe. Rather one must explicitly permit
it via the .java.policy file. That in turn means I no longer have to
make it local, but can give it permissions on the server  URL.