The mess above is an off-the-shelf ESP-03 module connected to the Pi much like my very first attempt. What's different is that in this case the SPI flash has not been removed, and not all SDIO pins being used. This has been clocked at ~20Mbits/s to a nearby router.
What makes this interesting? It proves that there is a way to connect some unmodified ESP8266 modules to the Pi. It also proves that 1 bit SDIO at 50MHz does not throttle the WiFi connection beyond usability. Most importantly, it means that anyone is free to make and sell a Pi WiFi board using the ESP-12E and -12F modules without going through FCC/CE certification.
There were two problems: a bug in the SD host driver for the Pi's processor that prevents forcing 1 bit SD mode, and a problem where tying /HOLD to ground to keep the SPI chip inactive was causing the associated ESP signal (SD_D2) to set some sort of strap value that gets latched at reset and seems to affect the loading of the WiFi firmware.