An ICS patch does appear to be in the works.
As for CM, you're right, it will never have PDroid, and I'm really beginning to wonder if they will even bring any permission management into CM9. If you look at the PDroid patch, it's not a huge amount of code, meaning if Google wanted android to allow privacy, they would have added it long ago. But the frankly rather seedy business model of Google and many "free" app writers and Facebook is the harvesting and selling of personal information, and they apparently threatened to cut CM off from Market access if they added strong privacy.
Clearly the long-term solution is Google-free phones running Debian or Ubuntu, but until then, there's PDroid.