You seem to be well on the way to cracking this. @mbrugman has a good point about the programming header. If you find something like that (through hole or pogo pin test points) then you night get lucky. Look for something with a weak pull high resistor like 10k ohms or so.
This is a deep cut, but I recently made this test firmware for observing spi while on a shared bus.
In spi mode the Z/z commands enable/disable the spi pins. So for example you could go into spi, run Z to disable the pins, then W to enable power. Now watch what happens with the pin voltages. If they twiddle a bit then the main CPU or whatever is accessing the flash.
Your bus pirate is already in SUMP mode, so you can use Sigrok/pulseview (sorry, on mobile, but check the docs) to do logic analysis while in Z (spi disconnect) to get a look at what’s happening on the pins.
Happy to help. If we can come up with a toolkit for these situations everyone is better off.