What does the padlock in the browser's address bar actually guarantee, and what does it not?

Only that the connection is encrypted to a party presenting a certificate for this host name that chains to a root your device trusts; not that this party is the real site, nor that nobody in between can read along.

The padlock is a statement about the TLS connection and the local trust store:

• It does guarantee that the traffic between the browser and the TLS endpoint is encrypted and integrity-protected, and that the endpoint presented a valid, unrevoked certificate for exactly this host name, issued by a CA in the device's trust store.
• It does not guarantee that the endpoint is the actual web server. If someone controls a CA your device trusts, such as a company proxy CA installed by Group Policy, a compromised public CA (DigiNotar), or a sub-CA sold for inspection, they can mint a certificate for any site. The padlock then looks identical while a proxy reads everything.
• It says nothing about the site's honesty. Phishing sites get free certificates too.

That is why browsers dropped the green padlock: it suggested "safe" when it only means "encrypted to someone the trust store vouches for". For sensitive things like e-banking, the network you are on matters, and clicking the padlock to read the certificate's issuer is the quick check: a bank's certificate issued by your employer's or hotel's CA is a red flag.

Go deeper:

• CISA: HTTPS Interception Weakens TLS Security — how inspection proxies sit behind the padlock and what can go wrong.
• Wikipedia: Transport Layer Security — what TLS authenticates and what it does not.