I have to amend my earlier post about the tombstone light not being flush with the fender. It didn't appear to be flush when the bike was delivered to my house, but it turns out that it is. When I took it apart, I didn't consider how the dealer had stuffed the wiring into it when he installed it. But after trying to re-install it myself, I see now that the trick is to get the wiring stuffed into the hollows inside the housing so it can be pulled all the way against the fender when you tighten the bolts. If you can do that, it's a good fit, and with the rubber gasket in place, it seals just fine.
I don't think the dealer worried about that too much when he put it on, but now I see the difference it makes.