Went ahead and tested Disguise more thoroughly to add to the info in the OP.
Trivial / Expected:
- Disguise can activate only once for each Mimikyu, but multiple Mimikyus can each have Disguise activate in a battle.
- Secondary effects of moves occur before Disguise is busted (e.g. Shadow Ball gets a Special Defense drop, Scald gets a burn, etc. then Disguise is busted).
- Disguise can activate at any HP.
- OHKO moves do not bypass Disguise.
- Non-direct damage cannot bust Disguise; I tested Toxic, Wood Hammer recoil, Aftermath, and Rocky Helmet, none of which busted Disguise.
- Skill Swap / Role Play / Gastro Acid / Worry Seed / Entrainment / Simple Beam have no effect on Disguise. If Mimikyu uses Skill Swap / Role Play / Entrainment via Mimic or Copycat, it will fail.
- Trace cannot copy Disguise, which causes it to always copy Mimikyu's partner's Ability for Doubles, or activate as soon as another Traceable Ability switches in for Singles.
- Receiver / Power of Alchemy cannot take Disguise. Mummy does not force Mimikyu to change Abilities.
- If a recoil move (e.g. Flare Blitz) is used on Disguise, the Pokemon using Flare Blitz takes no recoil damage. If Mimikyu holds Rocky Helmet, the attacker still takes Rocky Helmet damage.
- Ditto / Smeargle using Transform cannot activate Disguise, regardless if Mimikyu was busted or not at the time of Transforming. Transform does copy Mimikyu's current Disguise state (busted or not busted).
- Illusion copies Mimikyu's current Disguise state (busted or not busted).
- Eject Button / Red Card / Kee Berry trigger after Disguise is busted.
- Damage-halving Berries (for Mimikyu's case, Babiri, Kebia, and Kasib) will not activate if Disguise is intact.