Electrical – put a zener diode *before* PTC to protect the supply

The behavior you describe reproduces in the simulated circuit exactly. If we configure the Zener to a 25 reverse voltage and have it in the circuit the right way, Q1 drops around 25V. If we reverse the Zener, we get approximately two junction drops, as you found empirically. So it looks like you have the right circuit, and that the Zener is marked wrong. The stripe on the diode should correspond to the cathode bar on the schematic.

A long-standing rumor is that NTE buys other manufacturers' semiconductors and stick their own name and their own NTE-specific part numbers on them, possibly after testing the parts to figure out what they are. Maybe your diode came from a batch that ended up as NTE because they were marked backwards.

This is actually fairly common, though you'll also want a diode in line with your 12V supply as well. It is called "diode auctioneering" in the power electronics industry and I've seen it used in an extremely high power system (megawatt range) to switch between kilovolt-range redundant DC power sources.

^{simulate this circuit – Schematic created using CircuitLab}

The varistor should be sufficient as protection in my opinion, though you may want to consider a TVS diode as well. It will only be needed for the brief instant that the diode is reverse-conducting, though it may not be necessary. When the 12V connects (and the 5V is already there), the diode takes a bit to start blocking (reverse recovery time) and so the 5V line will see a burst of 12V, but it may actually be able to absorb that since it will quickly be removed. Never hurts to be safe though with the protections.

You will also want to make sure your regulator will behave nicely with the sudden jump up to 12V. It could produce a transient on the 3.3V line, depending on the type of regulator you are using. AFAIK linear regulators (like the 1117) are usually pretty good at this, but I'd check anyway.