Fair enough, Jonathan. I followed your instructions and the site got the 'all clear' from free Sucuri SiteCheck malware scanner.
I also checked the header.php file - all good - and changed the passwords on the two admin accounts. Do you have any tips about where I might go to see if I can work out what is continuing to cause the homepage problem with the GSAP animation? I guess you are confident that the problem is not with GSAP as such - it seems to be with the way Wordpress is loading the JS files. But the strange thing is I presume it loads them the same way on each of the two pages that I have provided URLs for, and yet they behave differently. There is something unique about that homepage that is disrupting the GSAP display while it works just fine on the test-page. Same website, same template, same GSAP HTML, JS and CSS. Different results.