The problem was solved! Some notes:
Regarding "ring number 1": This works even with Caller ID (which is sent from the CO after the first ring); in practice, it does not need to be set to 2 to ensure Caller ID reception. It was tested with 10-15 calls; CID was received and displayed on the sets 100% of the time with "ring number 1" configured. (Actually, if you don't configure it at all, it won't be displayed in the config, because "ring number 1" is the default. So leave it that way.)
"ring number" is intended to be the number of rings after which the router will answer the call and process it, which is great if it's acting as an automated attendant. Since I'm not currently wanting it to act in that manner, I didn't want the router to answer the call (defined here as the VIC port going offhook) until I lifted the handset of the IP phone. So I set it to a nice high number so that it wouldn't answer a call without me being present (since there is an answering machine connected to the line in parallel with the VIC2-4FXO). Apparently this wasn't such a hot idea.
If Caller ID is enabled, then the phones will not start ringing until after the number of rings defined by "ring number", even if "opx" is used (see below). This, combined with the improper numbering of ephone-dn 100, was the cause of the problem. (A Cisco engineer has told me that it's best to have all ephone-dn numbering be the same length system-wide -- hence "number 100" instead of "number 10", since my other phones' DNs are 101 and 102. I don't know why [or even if!] this is the case, but it can't hurt.)
Regarding "connection plar opx 100": The "opx" (Off Premise eXtension) prevents the VIC port from going off-hook, thereby answering the call as far as the PSTN is concerned, until the receiver is lifted on any of the ringing IP phones; this is useful when other devices share the POTS line, like an answering machine or cordless phone, which might want to answer the phone by themselves.
It should also be noted that distinctive-ring support is nonexistant. If you have an alternate phone number for the POTS line in question which causes the line to ring differently, such as short-short (or long-short-long or short-short-long), there is absolutely no way to discern that with any setup that I know of. I have distinctive-ring support, and the router considers a short-short ring to be two separate rings -- thus breaking Caller ID reception (since it starts ringing the sets with "Unknown Caller" before the first real ring cycle has even finished).
My fax machine listens for short-short distinctive rings, and is connected to the POTS line between the VIC port and the wall jack (same goes for my cordless phones and answering machine). As a result, it's still able to answer the phone only when it should. I don't think it's possible to connect it to an FXS port to have the router shoot calls over to it only when necessary, due to the lack of any distinctive-ring support whatsoever, which is a shame. Please let me know if I'm wrong on this!
What follows is a sanitized version of the voice portion of the config which now works on my 2821 with IOS 12.4(3) and a VIC2-4FXO:
! ! voice-port 0/3/0 ring number 1 connection plar opx 100 caller-id enable ! ! dial-peer voice 1001 pots incoming called-number . destination-pattern 9T direct-inward-dial port 0/3/0 ! ! ! telephony-service load 7960-7940 P00307020300 load 7971 TERM71.DEFAULT max-ephones 52 max-dn 192 max-redirect 20 auto assign 1 to 2 timeouts interdigit 3 system message Cisco CallManager Express time-zone 12 time-format 24 create cnf-files version-stamp 7960 Oct 10 2005 22:54:41 max-conferences 16 gain -6 moh flash:en_bacd_music_on_hold.au web admin system name foobar password foobar dn-webedit time-webedit transfer-system full-consult ! ! ephone-dn 1 dual-line number 101 label Extension 101 name Joe Schmoe ! ! ephone-dn 2 dual-line number 102 label Extension 102 name Uncle Bob ! ! ephone-dn 10 number 100 label 613-555-1212 name PSTN ! ! ephone 1 mac-address DEAD.BEEF.BABE type 7971 button 1c1,10 ! ! ! ephone 2 mac-address C0FF.EE00.BABE type 7960 button 1c2,10 ! !