Well, I only looked at the SNES-side Super Game Boy BIOS code. It looked for the #$f1, and then it looked at bytes 2-16 of each packet and compared it against a copy it stored inside the BIOS itself. The other values can be anything and it still works.
That you've figured out the exact details from RE'ing the 256-byte GB-side BIOS is quite amazing, thank you. I had to fake the packets being sent on reset to start the SGB program, but it would probably be better to emulate the boot ROM and have it do that for us.
