DeltaSlim What I've not seen anywhere is a real clean explanation of what exactly we could expect to see in the event that spyware were to fire on a Graphene device.
Nothing. This is the truth. You're using the tool of attestation for something it can't fulfill. Read the next paragraphs.
DeltaSlim Surely at the level of the infected device it would boot in a way that mimics the boot process for GOS.
No. It would either get cleared away when you reboot, or stay on the device and re-exploit the OS at every boot. The latter can be mitigated by security updates that fix the vulnerability that allows this re-exploitation, so updates plus verified boot give you the powerful property of being able to heal from an infection, at least on the level of the OS, which is meaningful from a security point of view because the OS enforces security settings and permissions. It could still have infected other apps on the device not covered by verified boot.
DeltaSlim I suppose either a message indicating that the device had failed the check
Possible (that's included in what I said that you quoted), but unlikely.
DeltaSlim or a successful "pass" to another HSM?
Possible, and more likely than the previous because it's less noticeable, but it would be apparent in the Auditor app's report, and included in what I said that you quoted. You need to read the entire report and pay attention to the first line and the timestamps at the end.
DeltaSlim MIE
MIE is an inferior version security-wise of what GrapheneOS on Pixel 8 and newer has already provided much earlier than Apple. Read Apple's blog post, the memory tagging only covers “key” areas, whereas GrapheneOS covers almost the entire base OS including all preinstalled apps (including Vanadium, and the system WebView which other apps usually embed) in a mode which the GrapheneOS team claims is pretty much equivalent security-wise to the synchronous mode used now by Apple, in addition to being able to enforce memory tagging on any app you install, which is impossible in Apple.
DeltaSlim lockdown mode
Apple's Lockdown Mode is not a security feature, it's a security weakness. It ties together security features in a way that forces you to take all of them together if you can, or none of them if not. GrapheneOS provides all the benefits that Lockdown Mode/Android's “Advanced idontrememberwhatitscalled trash” enabled provide (and beyond) in the default installation, and doesn't tie together security features like this to allow you to have something in the middle in addition to the two extremes.
DeltaSlim I know GOS does a lot to harden the OS in general
This is the key here. You can't detect spyware compromise with Auditor, but the OS does much more to prevent and contain an advanced infection, and Auditor allows you to see that the OS is what you expect it to be (official GrapheneOS, roughly an up-to-date version) rather than an unofficial fake GrapheneOS version. Even if you consider the OS to be compromised, it doesn't necessarily mean that the OS-provided section in the Auditor output is completely untrustworthy, because all OS components are sandboxed, so an infected OS doesn't necessarily mean the OS was completely taken over.