My brain dump is complete, and the driver is in Github. Feel free to play along, and contribute if you like.

I used some snips to carefully cut away the perfboard underneath the antenna, and it does seem to help with the connection across the house to my main AP. I get ~300kbits in iperf, which is terrible, but the 1.5Mbits I was seeing before was with a second AP sitting less than a foot away. Later on I'll try using the AP again, but with WPA turned off to reduce any overhead.

I also hooked the CH_EN signal to a GPIO on the Pi. When I toggle the GPIO off and on, the ES8266 is re-detected on the bus. Next step is to modify the driver to toggle power before attempting to load firmware.