Authentication access policy for intranet site / APM Module

In scenario 3, is is easy enough to have the APM accept the credentials supplied via Basic authentication from the browser?

Absolutely. It's built into the 401 response agent.

Also, if a user does have a kerberos ticket, but after our AD query we find they don't have the desired authentication, would it be easy enough to pass the user to the forms based login?

Yes, that would be pretty easy. But curious, if the Kerberos ticket they requested from the local KDC wasn't acceptable, what credentials would you expect in the logon form?