Replicant

I'd like to suggest Sony Ericsson Xperia Play for your consideration.

Minimal requirements

1. Has been officially supported by CyanogenMod (ics was the most recent official build #Note!). CyanogenMod Wiki page = http://wiki.cyanogenmod.org/w/Zeus_Info

2. Can be flashed via fastboot, CWM (usually included in the kernels on XDA) or FlashTool (linux, win & mac gui tool for xperia devices. www.flashtool.net )

3. I'm guessing the kernel isn't signed due to the availability of so many different kernel variations from different devs on xda but please don't take my assumption as fact. Roms & Kernels Index on xda = http://forum.xda-developers.com/showthread.php?t=2184897

4. Has published kernel 2.6.xx source code (linked to on the cyanogen mod wiki https://github.com/cyanogenmod/semc-kernel-msm7x30).

5. device was released with gsm and cdma varients.

Note = Has a mostly working cm11 build and has a mostly working kernel for it curtsy of legacyxperia devs here = http://forum.xda-developers.com/xperia-play/development/dev-play-neo-l-legacyxperia-t2802932 . Their homepage with more information and an issue tracker is here = https://legacyxperia.github.io/ and sources are here = https://github.com/LegacyXperia

Good target

1. bootloader comes locked by default but can be easily and freely be unlocked. http://developer.sonymobile.com/unlockbootloader/

Other = Has easily exposed serial access underneath a sticker below the battery. I don't know how functional that is and I don't have a usb serial card to try. Inspecting the motherboard's pcb to find out if it's usable is probably a little beyond me.

That's it, I don't believe I can provide any more useful information to meet the criteria. However, I am comfortable in a shell and I'll happily provide any further information requested that I can get too via adb on my device.