Well, at last, here it is. Booting from flash works well, and all local links are rock solid at two clocks.
A couple of things I've noted:
1) For the xscope link to work the JTAG connection needs to be really short. I started off with a few more cm of JTAG ribbon cable and no joy.
2) I should have allowed for more flexibility in the VCC supply converter. Power up isn't monotonic, but adding a feedback capacitor and a bigger output cap fixes it. Fortunately there are places I can tack these parts on, and I'll include them properly in the next revision.
At the moment I'm using the IS25LQ016B. I'll also experiment with the LP part.