Good news first: AP mode works with the standard hostapd setup. That means Zero-based routers, WiFi VPN tunnels, honeypots,...
Bad news: If you want your own, you're going to have to make it yourself. FCC type certification is too costly for a niche product like this, even more so when it's already shaping up to be a more expensive board than the Pi itself.
I had a plan to work around this by using the exposed SDIO signals on the FCC approved ESP-12E module. The trick was to force the SPI flash, normally used for the program flash and shared with the SDIO, to stay quiet. This would have had the side effect of forcing the ESP8266 into 1-bit SDIO mode and lowering throughput, but it would make the board easier to assemble and satisfied the FCC. I experimented on an ESP-03, wiring all but the uppert 2 bits of the SDIO bus and forcing the SPI flash's /HOLD signal to ground to keep the flash chip in tristate. In practice, this didn't work:
It looks messy, but the edges on the SDIO handshake look nice and clean.
Edit after sleeping:
Last night I noticed that the SD_D0 signal had some "toothiness" while high, as if another device were trying to drive the signal. SD_D0 is multiplexed with the DO pin of the SPI flash. The other signals we're hijacking (DI, CLK, /CS) are all inputs to the flash in 1-bit SPI mode. Now that my brain is on right, this suggests that the SPI flash wasn't honoring the /HOLD request. I can think of a few reasons for this, so ignore my doom and gloom.
If this scheme does work, the main side effect would be that SDIO would be reduced to 1 bit mode. Throughput between the Pi and ESP would drop from 200Mbits/s to 50Mbits/s and would become the bottleneck. This is probably a good trade-off: no certifications needed, simpler assembly and BOM, and much better availability in the US of ESP-12E modules vs. bare ESP8266 or ESP8089 parts.
If someone has a hook-up at AI-Thinker, suggest to them that they make an ESP-12E (or -F or whatever) with the SPI flash left unpopulated. That would be ideal.