You got further with SDK 1.1.1 than me.
My firmware didn't come so far and didn't startup user_init.
I am quite sure that I can locate WDT errors in general if I find some time but until then:
I think I remember changes in the printing of wdt errors in the SDK.
If you run the SDK 1.1.1 version with 74880 baud or maybe 115200 baud the wdt reset message
may contain additional info like epc1 etc.
That may tell us the last known location before watchdog feed got cut off.
Using the mapfile/objdump it should be straightforward to identify the code.
That may help.
Regarding SDK 1.0.1: Good work.
But pure binaries are less than this https://github.com/tuanpmt/nodemcu-official-sdk.
But as you know finding your own way is fun, so I will try it myself, too.
It would be nice if you publish your versions to compare and learn from.
Cal