I went wild with an ohm meter and scope last night. I had hoped the connector next to the flash might provide the ability to program the flash in circuit. No luck there but here's what I found:
20 pin unpopulated header next to flash chip appears to be an LPC (low pin count) expansion bus pinout as follows:
1 - vdd
2 - vdd
3 - gnd
4 - reset# (pin 2 of 49lf002)
5 - gnd
6 - r/c# / clk (pin 31 of 49lf002)
7 - gnd
8 - dq3/FWH3 (pin 17)
9 - gnd
10 - dq2/FWH2 (pin 15)
11 - gnd
12 - dq1/FWH1 (pin 14)
13 - gnd
14 - DQ0/FWH0 (pin 13)
15 - gnd
16 - we/FWH4 (pin 23)
17 - gnd
18 - rp3 pin 6 (near CS5335 row 1, U side) probably LPC_DRQ# or LPC_SERIRQ
19 - gnd
20 - rp3 pin 8 (near CS5335 row 1, A side) probably LPC_DRQ# or LPC_SERIRQ
jumper j10 - A3 (id3) and VDD
IC (pin 29) connected to VSS (pin 28), i.e. ground. i.e. firmware hub mode!
J7: 14 pin Jtag connector! Pinout appears to be described here: http://www.fs2.com/geode_download/Geode-Getting-Started.pdf I only verified the power and ground connections.
I haven't found any free jtag software that digs a Geode.