In the end I've gone with a buck regulator found on eBay for $1.70. The chip on it is rated for up to 40V input, tolerating 45V absolute maximum. I tuned the module to give 5.00V output (needed for the relay coils), and further regulate that down to 3.3V (LDO tab regulator) to run the electronics.

This all works fine, but I'm very slightly concerned about something. The DC input produced from the "24VAC" supply ends up being about 38V after the filter cap. That's under 40V, but not by much at all.

To give a little more head room, I've inserted three diodes in series with the 38VDC, dropping it to about 36.8V (gotta double check that measurement). The current flow through it is typically less than 100mA, up to 225mA peak when all five relay coils are active.

The slightly nagging worry is that there's still not much margin there at the input to the buck regulator. It does appear to be of good quality -- 50V input cap, 35V output cap, etc.

Should I be concerned (much)?
I wonder if a 40V zener across the DC input might be useful?