Use the Spartan 3AN family quite regularly.
I always recommend a POR circuit. A delay is required to ensure voltages are stable, but with the power system I've been able to employ, this is not an issue. This allows me to connect a PU to nPROG and a 2-pin jumper or PB switch.
As I understand it, you set the M[2:0] bits to 011 for internal SPI boot or 101 for JTAG, and pull PROG_B down, then up to program.
The internal configuration engine will automatically enter a configuration cycle. The type of cycle depends on the settings of the mode pins. The pins are sampled by the FPGA after nPROG is released. If the designer wants to delay configuration, there are a number of ways to do that, and holding nPROG is one. Configuration will not start until nPROG is high, the on-chip voltage detection circuit has qualified the voltages, and the internal configuration memory has been cleared. At this point, the mode pins are sampled, and the configuration engine proceeds accordingly. The settings you give for the mode pins are correct.
-Do the M bits really need to be twiddled? I was assuming (for some reason) that JTAG boundary scan was always active? That is I don't need to boot from JTAG; I do need to use it sometimes, to write the flash..
No, the mode bits need to be stable. If you want to change the configuration method, you can twiddle the mode bits and cycle nPROG. Generally speaking, the mode pins are set for the default configuration mode and never changed.
The JTAG setting of the mode pins simply locks out the other configuration modes. Setting the modes pin to 011 does not prevent the JTAG interface from taking control of the part for debugging (Chipscope), configuration, or for indirect programming of the on-board SPI Flash.
On the 3AN family, programming the on-board configuration Flash is an indirect operation. Using JTAG, a special configuration is loaded using the JTAG programming interface and then started. This FPGA configuration provides access and control of the SPI Flash bonded on the FPGA carrier board along with the FPGA die. The desired configuration image is then downloaded to the FPGA using JTAG and the special FPGA SPI Flash programmer writes the data to the SPI Flash device.
-VS[2:0] bits appear to be pulled up and not do too much... Can I just leave them disconnected?
Both the mode bits and the variant select bits have internal pull ups. You can simply connect them to ground for a logic 0, or let them float for a logic 1. I always connect them to PUs. I don't trust the high impedance PUs in the FPGAs.
-I am grounding SUSPEND...
I leave SUSPEND unconnected.
-Am I forgetting anything else?
You need to PU DONE. I always pull up DONE, and always connect an LED (Red) that is on when DONE is low (not programmed), and off after configuration is complete. It's a simple two component BIT circuit.
Hope this helps.