The railroad diagram in 2.1. Combining Media Queries does not allow a trailing comma:

But later on, in 3. Syntax, it says "To parse a <media-query-list> production, parse a comma-separated list of component values".
And parsing a comma-separated list of component values does allow a trailing comma.

I'd assume the trailing comma is allowed, especially since the railroad diagram is called out as "informal", but from what I can tell, it is still in a normative part of the spec.

(I haven't yet checked how browsers actually implement this, so that guess is based purely on the spec.)