As to what the issue was - in the end, as it usually is, it was pretty simple. Like the old joke about the guy getting paid for knowing *which* button to press
I began by porting in TG's changes. In the end, not all of these were necessary, and for ease of merging with ongoing CM9 development, I trimmed down to just what was needed: we need to ignore all the ICC (generic term for SIM/RUIM) stuff since this phone has no ICC, and handle the fact that the subscription info returned has only 4 elements, not 5 (and taking the PRL--normally the 5th element--from system properties).
At that point, it got further, and you can trace my previous posts to see how I decided to examine rild. I thought since rild was running and we had the same rild and qualcomm libril libraries, behavior should be the same so I was looking for some way in which they were configured differently. That led me to look at rmnet0, which the RIL was supposed to be bringing up in the step that errored. (Keep in mind that at each of these steps I'm doing lots of googling to get an overview of what people know - googling "SETUP_DATA_CALL," "rmnet0," etc..)
So rmnet0 is a kernel device driver, so that means code. Yay! But our kernels are the same, so I decided to look at the parameters (experience here).. That's when I saw the ETH/RAW_IP difference. That was a symptom, not a cause of the issue. Looking at the kernel source, I could see an ioctl (system call from userspace into the kernel) that would make that change, so (experience) I thought an strace would yield perhaps if the ioctl was failing or whatnot. The strace ended up yielding a lot ... I should have started there. What libraries/sockets/files rild opened up (especially with the -f option, which traces child processes that fork off). Then of course I saw the qmux_socket_connect opening failing that I mentioned.. more googling and looking at qmuxd, which should create that file. qmuxd must have died! It's started the same way in TG's and our init.qcom/triumph.rc ... Well, I tried in vain to get a dump of why qmuxd was dying - eventually, after looking closer at the ps I realized - duh, it's never starting. Then it clicked - the ps showed all the daemons in init.triumph.rc that had "class main" were running, and none that didn't. I went through adding "class main" to all the non-disabled services.
Then, with TG's changes and the class main changes, I got 3G flickering on and off. Traced that to a crazy version number in the log - I had turned off the datacall,signalstrength compatibility line at some point. Re-enabled that, and 3G was good. I just now pared down the changes to just what's needed, pushed them to my github, and sent mantera pull requests.
Hopefully this all will be useful/interesting to some. Like I said, often have to jump through a lot of investigative hoops to fix a silly simple problem

One potential bonus - some of our other problems may stem from other daemons which weren't being started. Not sure why only class main now gets started in the vendor rc file.