Q: "does any of the GPIO pins change state on shutdown, such that a HAT could use it do detect shutdown and react accordingly, with no need for additional software?"
Yes - or at least they can be configured to do so using the device tree overlay called gpio-poweroff. As you're aware, unlike most personal computers, the RPi does not include any hardware to remove power from the device. Consequently, when you command the RPi to shutdown, poweroff or halt, the processor stops all processing, but the board continues to draw power. All schemes that I know of utilize the gpio-poweroff overlay to trigger the physical disconnection of the RPi from its power source - thereby bringing it to a zero-power state. Another answer here shows one of several schemes that have been successfully implemented using gpio-poweroff.
Note the oscilloscope trace below: This shows what the gpio-poweroff signal looks like when triggered by the device tree overlay - which may be added with a single line in /boot/config.txt:
dtoverlay=gpio-poweroff
You can find some version of the documentation on device tree overlays and parameters in the local file on your RPi: /boot/overlays/README. The current overlay documentation is available here, and should be consulted to ensure you're working with the latest information.
As you can guess from the trace below, the gpio-poweroff signal provides a useful signal to control the hardware that removes the 5V power input to the RPi; e.g. a latching relay.

Finally - there are approximately 50 answers here in RPi SE that mention the gpio-poweroff overlay; I've authored 9 myself. You may pick up a few ideas from perusing these.
/usr/lib/systemd/system-shutdown- as per https://www.freedesktop.org/software/systemd/man/systemd-halt.service.html – Jaromanda X Nov 03 '22 at 03:04