Thanks for the replies. I don't believe I can insert php code into the page and have it execute, but I'll check with the web host. The pages all have .html extensions, but (I hope) maybe they've set set up .html files to run as .php.
That'd be my first choice, but if that's not possible I wonder if it's alright to use "all of the above" at once:
1 - Zero-second meta refresh.
3 - Cross-domain canonical
4 - Edit internal links to point to new page location (site's only about 50 pages, so not super hard to do).
Or is that redundant, since the meta refresh would whisk SEs away before they ever saw any of the other stuff?