I'll answer my own question.
In my steps above, before I "Then I associate vmnic2 to the the new Uplink port. When I press save, the task goes off and tries to propagate this change to the host" , I need to break the NIC failover configuration that I never set up and thought that I had specifically disabled for my vds. But that is not how it is done.
Before we can associate a physical NIC on the host to the new Uplink port, we need to make sure the uplink port is not being network teamed. This is a policy that is set at the Port Group. So each Port group in the vDS must be modified. There likely a way to set this as a standard Port group policy, but for now we’ll do it per port group.
Despite turning off Nic Teaming, and LACP (must be turned off for port mirroring), vmWare automatically tries to load balance VMs across active Uplink ports. This can cause problems other than for mirroring (I had both VM Nics on an EH1000v get associated to the same uplink port at one point) .
In the Edit Settings panel, select the Teaming And Failover menu item. The new Mirroring Uplink port will be listed in the “Active uplinks” with the other uplink ports. Click on the newly created uplink port and use the Arrows to move the port to the “Unused uplinks”. This does not mean that port is not used, just not used in the failover/load balancing rules described in the top of the dialog.
Now you can go Add a physical nic on Each Host to the VDS and associate to the Span out port