Well, that wasn't so bad. I've now got an exactly 4 MByte file with a binary dump of the entire flash chip inside. Oddly enough, none of the flash is write-protected either, according to the chip status register.
I'm going to dump it a few more times and check for bit errors between the various dumps. Meanwhile, here's a look at the logic analyzer display during the dumping..