... "It turns out that Espressif has written a wifi_send_pkt_freedom() function that just sends out whatever packet you’d like to the network. That was easy." ...

That was easy: the esp_iot_sdk removed the ability to send wifi control frames with wifi_send_pkt_freedom.
See the ESP8266 packet injection/sniffer example at https://github.com/pulkin/esp8266-injection-example for an example of code and the required (old) SDK included in the project