Aha, found it! Here I'm building on miki's answer which showed the way but didn't fully solve this for me.
As it says in the Spanish-language article about launching Hudson builds which was linked to from the comments of Hudson's Remote access API page that miki linked to:
En la sección "Build Triggers" [...] marcamos la
opción "Trigger builds remotely (e.g.,
from scripts)". Al marcar esta opción vemos como aparece el cuadro de texto "Authentication Token". Aquí pondremos el nombre del token de autenticación.
(It seems the benefits of knowing Spanish are starting to materialise... :-)
So, turns out Hudson provides a handy built-in option for triggering builds remotely. In Build Triggers section (of Upload job in my case) you can enable remote builds and set an auth token (see screenshot above). Then you can launch a build by accessing a certain URL containing that token. In my case, the first build step of Launch-instance looks like:
wget http://[hudson-url]/job/Upload/build?token=TEST
sleep 10
This works even if anonymous builds are disabled and simply trying to access the build URL would yield "403 Forbidden".