You have to understand that both transports have a different threat model than yours. They both address "blockability" while you need to address "detectability", or as meek's threat model docs put it: "observability".
You mention that:
My primary concern is to avoid being flagged in dragnet surveillance by either my communications or by my Tor usage
Hiding the fact that you're even using tor is much more difficult than hiding the content of your communications.
Both bridges (and tor bridges in general) try to achieve the same goal: to not be blocked by standard detection methods. None of them are listed in the main directory. From the tor docs on bridges:
Since there is no complete public list of them [the bridges], even if your ISP is filtering connections to all the known Tor relays, they probably won't be able to block all the bridges.
Using a bridge in your situation is better than not using it, but it might not be enough to hide the fact that you're using tor.
This are the protections offered by bridges:
- Block by content: censor will not be able to see what the content of your communication is
- Block by address: censor will not be able to know who you're talking to, or whether the other end is a TOR relay
- Active probing: for obfs4 a probe would require the node ID and the public key, which can't be easily obtained because bridges aren't easily enumerable. For meek an active probe may be able to determine there's a domain-fronted relay, but not whether anyone communicating with the CDN actually used it.
They both try to provide some protection against fingerprinting of headers, traffic patterns, etc. But it's not their primary goal.
Even though with meek you're connecting to a CDN that's used by lots of sites, your traffic patterns may be very different from those of other users not accessing a tor bridge.
Also, with meek you mostly depend on HTTPS and its PKI. If your government controls a trusted CA you will have to take extra care of not being MITMed on your way to the domain front. This might mean removing their CA from your trust store, and doing that might give away that you're doing something private.
Both bridges will offer you similar protection, but they aren't specifically designed for your problem (hiding the fact that you're using a private communication channel).
They do, however, hide that fact from most automated detection tools, because that's a precondition to bypass blocking.
This might be enough for your case, but be very careful and implement additional measures where possible.