With the momentum from pcunite, I did post my setup to his new cleaner thread: http://forum.mikrotik.com/t/bypassing-at-t-residential-gateways-with-mikrotik/135563/9
tl;dr is that I still have the VLAN 0 problem, but it is mitigated by a script I wrote to manage the bridge interface based on dot1x status.