A small discovery I made along the way:
a) There are still cases where modern browsers (and RSS readers) will request favicon.ico from your website: You can offer something nicer like a PNG in your HTML, but if the user loads something that isn't HTML (an image, an RSS feed, etc.), how would it know to look?
b) The .ico format is just a container, the image inside can be in various formats
c) Most programs that work with .ico files insist on converting the contents to an old-school uncompressed BMP image :(
After trying and failing for a while to get ImageMagick to do what I wanted, ffmpeg came to the rescue: the command
ffmpeg -i favicon.png -c:v copy favicon.ico
does pack the input PNG into a .ico container without conversion! Hooray!