Yeah, I know that blocktrron (not @ing to avoid notification) was working on this a few years back (check that original author date of Tue, 6 Dec 2022 18:14:21 -0500 (00:14 +0100)).
He mentioned using it for Freifunk, and that its biggest problem is the construction of the power supply for the mPCIe slots; the power supply is/was weak enough that modern Mediatek cards would brown-out, which was difficult to deal with as they were firmware driven.
I believe for a bootloader, he originally built and used a version of u-boot. He shared https://github.com/blocktrron/u-boot-msm/. Looks like that's been bumped recently.
I never attempted to build this u-boot. I know that this Freescale board boots by using the bootrom / eLBC (?) to bootstrap the U-boot loader process from NAND. I don't know how the RCW is configured by the SMD components on the board, but https://github.com/blocktrron/u-boot-msm/commit/15378bc9e0d483a15ae9ab8fe1e712e88308b17f clearly indicates a particular TEXT_BASE for u-boot. I haven't looked back, but again, clearly that's a solved problem.
In terms of getting this U-Boot on, considering it's a NAND BGA, I reckon that, unless the user has a JTAG device like the BDI2000 or BDI3000 and the knowledge required to use it to rewrite NAND (I never got that far https://github.com/Hurricos/openwrt/issues/21), the process must be to use the original exploit we've found to gain shell access, then manually replace u-boot from within the OEM Linux shell.
A problem for OpenWrt supportability is that U-boot replacements generally "should be" maintained in-tree (see all the Marvell devices). I will be the first to admit that I am unqualified, and that I don't want to bother David to ask to maintain the u-boot port under the OpenWrt libc / build system.
That said, the 460 / 560 series are nice APs. I can look back in my email, it's possible he gave me direct instructions for how to build and I just neglected it because I was (and still am) not a great developer :^)