two possible nonces (-1/2 and 1/2) = 2x times more S candidates (not just (z+r)*2)
Yes, but s-value has to be lower than 0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a1. If it is not, then it will be non-standard, and then it will require contacting Bitcoin miners directly.
The four sweeps so far were done using -1/2 as the nonce. AFAIK the S normalization below N/2 is done automatically by ECDSA. So it worked fine.
2 SHA256 + 1 RIPEMD160 for every out address candidate
But why RIPEMD160? In case of P2WSH, it is never needed.
Well, the output scriptPubKey was the H160 of the public key, and was the first thing I touched to actually alter the message digest, in order to mine for short S values.
But you're right, the nLockTime worked. This hint bypasses EC math almost completely.