Looks like I'm going to answer my own question. I'm not sure how many will be interested but you can never know.
Update sep 18: Now there is a short answer that wasn't available a year ago when I first answered it. Namely, my own WebLock app:
https://play.google.com/store/apps/details?id=com.simionescu.vlad.weblock
Below is my original answer that gives a general idea of how this can be done programmatically.
So I went into digging and looks like it can be done. It wasn't even as difficult as I feared it would be, though I wouldn't say it was very easy either.
The main points are as follows:
I wrote an app that basically puts the site on the native Android lock screen. (Actually, I already had an app and I added this functionality to it, but that's less important. The main thing is that my method requires writing an app.)
So I guess this falls somewhere between the cases 1 and 3 above. I do need an app, but it's not a full-fledged custom lock screen, as detailed below.
This of course means that the method is more general, it works with any app, not just for displaying a site.
Set FLAG_SHOW_WHEN_LOCKED for the Activity window, as shown for instance here:
How to make our own lock screen in android instead of default lock screen
But I only used this flag, the other 3 mentioned in the link I didn't need.
Launch the Activity (if it's not running already) and set it on top before the device screen goes off, that is on receipt of the ACTION_SCREEN_OFF event. This way, the app is always visible when the screen goes off so next time it starts, Android will put it in front of the lock screen. (At least if it's the standard one; from the documentation it looks like it should be working with a custom lock screen too but I didn't test it. I guess it depends on how that custom lock screen is written. Anyway, I don't necessarily want my site on a custom lock screen, if the user has one he probably won't want to see my site in front of it).
This also means that the site will appear in front if the device is switched off then on, even if it's not locked. Which is what I intended.
Automatically start the app at startup via the BOOT_COMPLETED event
Capture the standard back key (which is allowed, unlike for the home key) and make it act like the home key when it would otherwise terminate the app.
I intentionally let the home key act normally. This of course means that after pressing it (which is the way the user exits the app and enters the device) the lock screen underneath is shown. Otherwise I would have had to deal myself with password-protecting the device, which is in no way something I want to do. There are a few drawbacks with this approach but IMO they're small. For simplicity's sake I chose to do it like this.
Besides, this way my app remains reliable, which it wouldn't have if I had hijacked the home key, no matter which way.
As said, this means that this is no full-fledged custom lock screen, just a way of putting the site over the default lock screen.
(update nov. 18) There's one more important point. As described so far, such an app could have a security issue. I'm not an expert so I'm not sure if it really does, and if so how important it is, but you can never be too safe. If the user can go unchecked to any site, when on the lock screen, it means that if the phone is lost and a bad guy finds it, he could go to a site that has dangerous code that could unlock the device. I'm not sure if it really could be done but I wouldn't be surprised. So, one good advice for anybody who writes such an app would be to severely (but reasonably) restrict Web navigation while on the lock screen.
These are the main points, there are a few other implementation details but I'll leave them out for the moment.
All this looks pretty standard and reliable to me, given that it's all in the official Android documentation.
I tested it on my KitKat device, plus on 2 emulators, one also with KitKat on it, the other one with the latest and greatest. Everything seems to work fine. Including the case when the device / emulator is password protected.
So I just wrote the app and published it on Google play. It's here:
https://play.google.com/store/apps/details?id=com.a50webs.intelnav.worldtime
Which means that now there is at least an app on Google Play which has this feature. It remains to be seen how well it will behave. I'll probably have to make minor corrections in the coming weeks, but other than that it should be fine.
Also in the coming weeks, maybe a month or so, I plan to put another app that will do this generally with any site, at the user's request.
(update nov. 18) I finally wrote the app and put it on Google play. It took a little longer than planned but it's ready. It's here:
https://play.google.com/store/apps/details?id=com.simionescu.vlad.weblock&hl=en
As noted above, when on the lock screen, navigation is restricted to the same domain, so that if a bad guy finds the phone he cannot go to some malware site and unlock it.