Thought I'd follow up here.  Tested this every which way, could not get an inbound connection going.

Then I switched to a different provider, one that offers static IP's.  No router config changes beyond what's required to authenticate to the ISP - and it works like a charm now.

So... YMMV, but I'm thinking Skinny is indeed blocking inbound connections.