> I think the premise here is that a 4xx is an “expected” server issue

That premise is incorrect, as 4xx is client errors, as in the client formatted the request wrong or anything else, and therefore it couldn't be responded to. Rate-limiting is the client hitting the server too much, and it's up the client to handle this.

5xx is for server issues.

2xx should be success in any shape or form, so clearly 2xx shouldn't be used in this case either.

I agree that 429 should just be used for it's intended purpose here, handling rate-limiting requests/responses. You can still add a body if you want, with the current quotas.