Hello Tom,
you have made a nice job with these packet captures.
However, you are digging into low level details:
the exact specification of how CDP (Cisco proprietary) frames are used to allow communication between switch and Cisco IP phone is not available as far as I know.
We can guess that a Vlan field exists in the CDP frame and that the switch puts in it the right vlan-id when using voice vlan and then has to use special values to indicate other options.
For example I had read that also reserved vlan0 can be used in the case of 802.1p encapulation in the vlan-id of the 802.1Q header that needs to be used.
You say that when using untagged you see vlan field = 4095 in message from switch to phone.
This is possible and can be the way to say use untagged option.
All depends on how information is encoded if no flags bits are available and you have only vlan-id field using reserved values to indicate other possible encapsulations is reasonable.
For example, in MPLS LDP there is the so called implicit null label, but this is sent as a specific reserved value (3) in the label field of LDP message.
Hope to help
Giuseppe