I stand (very happily) corrected!  The WRT54GL will do WPA2-AES in Client and Client Bridge modes under DD-WRT.  I pulled one out of the box and gave it a go.  Tomato (1.28) disallows WPA2 in any mode but Access Point.  I expect my perceived failure of WPA under Tomato was related to my host router's settings.  I must have misconfigured DD-WRT to erroneously conclude it wouldn't work on my last attempt.  With four more of these in boxes, I might not need another router for years now!

TL;DR: The Linksys WRT54GL (and DD-WRT compatible versions of the WRT54G, GS) running DD-WRT in Client Bridge mode is also an ideal solution for wirelessing old Macs.