Here's a solution I came up with. Basically, the problem is that when you directly attach, the Pi has no internet if Internet Sharing is turned off, but the Mac can't access the Pi if Internet Sharing is turned on. (The Pi can access the Mac at 192.168.2.1, however.)
Either of these could be solvable if the Mac provided interface bridging (which it does in 10.9+, but it doesn't really work with WiFi, which I need), or port forwarding for its NAT using Terminal (which I've had no success with, and apparently completely changed from natd to pf in Mountain Lion).
So what I did is create a remote forwarding SSH tunnel, since the Pi can see the Mac. it is created when the Pi starts up and is attached to Mac ethernet with Internet Sharing turned on.
(To set this up, the Pi serial console, but a screen+keyboard would have worked just as well; I probably could have also used SSH to get into the Pi if Internet Sharing was turned off.)
change the default SSH port on the Mac, by editing /etc/services and changing the SSH line to TCP port 43188 (note: this means you have to use -p22 when connecting to normal SSH servers) [This is optional, but provides added security than using the default port 22.]
turn on Remote Login on my Mac in Apple Menu->System Preferences->Sharing. (If it was already on, then cycle it so it uses the new port.)
create a public/private keypair for SSH, with no passphrase:
ssh-keygen -N ""
copied the public key (id_rsa.pub) into ~/.ssh/authorized_keys on my Mac
copied the private key into /home/pi/.ssh/id_rsa on my Pi
made sure I could SSH from the Pi to my Mac, without a password prompt, as root:
sudo ssh firstname.lastname@example.org -p43188 -i /home/pi/.ssh/id_rsa
- added this line to /etc/rc.local on the Pi, before
ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p43188 -N -R2222:localhost:22 email@example.com -i /home/pi/.ssh/id_rsa &
Now, when I start up my Pi, and it's attached to my Mac via Ethernet and Internet Sharing on the Mac is turned on, it creates a remote forwarding tunnel in which when my Mac gets traffic on port 2222, it forwards it through the tunnel to the Pi's port 22. So I can type:
ssh -p2222 pi@localhost
And bingo, I'm in.