Reprogramming its controller board to use my own RF protocol
Here's a video where i have a look inside my two different bulbs. They're both quite easy to break into without destroying them, which is nice.
The Milight PCB
Image borrowed from Itay's teardown. My board looks the same, but they're using a white soldermask now. Probably for reflectivity, and also maybe to avoid reflecting green light (but I'm not sure whether that was even a problem before).
So the boards in both of my two bulbs seem to use the exact same circuit, the E14 bulb just has a slightly different layout. They're both using the same STM8S003F3 microcontroller and the PL1167 wireless transceiver, and they're both using the four PWM compare channels available on the STM8's TIM1 timer to control the four transistors driving the four (RGB+W) LED channels.
The STM8's TIM1 PWM outputs are on some of the same pins as its native SPI pins, so I guess they must be bit-banging the SPI communication between STM8 and PL1167. The SPI pins from the transceiver seem to be wired to PD2 through PD6 on the STM8. I've found several different development boards around Aliexpress and Alibaba using this exact combo of STM8 and PL1167, but they all seem to be using the native SPI. And even so I still haven't found much in the way of code samples for this combo.
I did, however, find another board that was very similar to the one in my bulbs. It has four PWM outputs so I'm guessing it's also using the TIM1 for PWM (ie also blocking the SPI pins), seeing as it's the only timer with four compare outputs. I messaged the seller for code samples posing as a development engineer for a sizeable project, but they won't send me any code unless i order a sample of two boards at 20 usd + shipping. Almost worth it, but since I can't be sure the layout is the same I'm a bit cautious. They seem to be the only supplier, so I guess they're careful with giving out their code to prevent people from cloning their boards.
In my research, I also found a goldmine of tutorials on the STM8 controller including SPI bit-banging, created by user Nevyn of the Netduino forums. These will be very nice to refer to if and when I get started with some actual development.