Thanks!
iMX's JTAG is exposed (it's what I currently use to upload the software), and likely is the FPGA's. (bitstream loading uses serial, so JTAG isn't used in normal operation). You're right that using boundary scan on both sides may work, or I could also just reverse enough of the iMX side to understand in detail what configuration is used to transfer configuration and waveform data (appears to be a multi-bit SPI bus, which sounds weird, I know). Reversing the existing software (plus running code and trying) is what got me LCD, Frontpanel buttons&leds, Ethernet, USB, UART(*) support.
But to be honest, I'd rather like to throw some money on the problem and do it the easier way. I'm mostly time-constrained on this project so I want to focus on the fun things. Especially I also need to map out other FPGA connections like ADC and the acq. memory.
(*) Unfortunately I didn't find any unused UART pins, so I'm using the frontpanel UART for debug spew.