have a similar situation (see how OpenBTS folks managed to get licenses for their burining man tests).

• Is there some part of the official gsm bands that overlaps with local ISM

or other not-so-tightly-regulated frequencies? (i.e, GSM1900 seems to have a small part that's not used by DECT...)

This is a rumour. Only one of the uplink/downlink bands is in there, so you will still need a test license. Also, AFAIK the DECT band is not everywhere unlicensed for any kind of application, but actually restricted to be used with the DECT system.

• Are there any "standard" gsm handsets that could be modified (preferably

in software) to work at 2,4GHz?

no.

• Is UMA/GAN (http://en.wikipedia.org/wiki/Generic_Access_Network) something

that could be used with OpenBSC? As far as i understand the specification, UMA is GSM Layer 3 over an GPRS/IPSEC tunnel to the BSC, so all the GSM-Goodies should be there.

You would have to implemet a UMA gateway and somehow glue that to the layer3 inside OpenBSC. I don't think you can do it cleanly with the current code.

Later this year, once the new "real MSC" codebase emerges, this might be easier.

Regards, Harald