"The net result is that CT gives us visibility into all web certificates [...]" including not always the desirable effect of publishing information on hosts in the non-public part of the institution network...
And it's true that CT is one of the various ways people might discover that although it's probably not even the easiest.
But honestly did you consider calling that purpose-of-software.internal.corp.example instead? And maybe at least use code names for projects that are actually secret?
Instead of normandy-invasion.corp.example at least call it overlord.corp.example and now it's not obvious where you're landing and I won't have lined up all the tanks and guns ready.