Having solved the RF part of the puzzle, we now have 8-byte data packets. As noted, byte 0 seems to be a constant 0x28 and byte 7 is a 1Wire CRC.

Bytes 1-3 are a unit ID, which changes each time you rebind the device.
Byte 4 is flags — bit 2 (0x04) seems to be the leak/theft alarm, which surprisingly is sent from the transmitter rather than inferred by the receiver. Bit 0 (0x01) is set when a magnet is held to the transmitter. We're still working out the others — it would be useful to be able to send packets and see how the receiver responds.
The top 6 bits of byte 5 indicate a temperature. We haven't fully calibrated this, but a value of 35 (decimal) seems to be -10°C while 17 is around 20°C.
The actual distance reading is 10 bits, from the low 2 bits of byte 5 along with byte 6. The value is roughly given in centimetres. The transmitter unit compensates for the fact that the speed of sound varies with temperature, to give a reading which should be relatively stable as temperature varies. A depth value of zero indicates a failed reading. The reading is quite unreliable under about 10cm.

When a magnet is held to the transmitter, bit 0 of the flags byte is set. The depth reading also switches to a countdown — which counts from 0x51 to 0x5a before the unit ID changes to a new value. The new IDs seem to be time-based, increasing every time. If the receiver receives these countdown messages with a high RSSI, within two minutes of poiwering up, it will bind to the new unit ID. The PIC in the receiver has a few bytes of EEPROM, so presumably the currently-bound unit ID is stored in there.

Support for decoding this has also been added to rtl_433, giving output as follows:

2015-12-08 20:43:29 Oil Watchman c7724c 80 17 0 137
2015-12-08 20:51:24 Oil Watchman 4ecc8c 80 23 0 57
2015-12-08 20:59:58 Oil Watchman c7724c 80 17 0 136
2015-12-08 21:23:38 Oil Watchman c7724c 80 17 0 137
2015-12-08 21:26:21 Oil Watchman 4ecc8c 80 23 0 57
2015-12-08 21:41:17 Oil Watchman c7724c 80 17 0 0
2015-12-08 21:57:17 Oil Watchman c7724c 80 17 0 136
2015-12-08 22:01:17 Oil Watchman 4ecc8c 80 23 0 57
2015-12-08 22:19:52 Oil Watchman c7724c 80 17 0 137
2015-12-08 22:22:24 Oil Watchman c7724c 81 17 80 0

The fields are unit ID (hex), flags byte (hex), temperature (decimal, raw uncalibrated value), binding countdown, depth (raw value). The latter two are of course taken from the same byte of the packet, depending on whether bit 0 of the flags byte is set.
The receiver unit has DIP switches which allow the size of the tank to be configured. It is possible that it also compensates for expansion of the contents.