I finally figured out how to get Ant + Ivy to copy artifacts from one Artifactory repository to another, modifying the appropriate metadata (AKA "promotion"). First, you need a separate ivy.xml file (I call mine "ivy-publish.xml") that looks like this:

    <ivy-module version="2.0"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:noNamespaceSchemaLocation=
             "http://ant.apache.org/ivy/schemas/ivy.xsd">
        <info organisation="foo" module="FooDeploy" status="integration" />

        <configurations>
            <conf name="integration"/>
            <conf name="milestone"/>
            <conf name="release"/>
        </configurations>

        <publications>
            <artifact name="Foo" ext="war" />
            <artifact name="Foo-src" ext="jar" />
        </publications>

        <dependencies>
            <dependency org="foo" name="Foo" rev="latest.integration"
              conf="integration->deploy" transitive="false" />
            <dependency org="foo" name="Foo" rev="latest.milestone"
              conf="milestone->deploy" transitive="false" />
            <dependency org="foo" name="Foo" rev="latest.release"
              conf="release->deploy" transitive="false" />
        </dependencies>
    </ivy-module>

And then, you need an ant target that looks like this:

    <target name="publish-stage">
        <ivy:configure file="${common.build.dir}/ivysettings.xml"
              host="myserver" realm="Artifactory Realm" username="user"
              passwd="password!" override="true" />
        <ivy:retrieve file="ivy-publish.xml" conf="integration"
              pattern="${ivy.lib.dir}/[conf]/[artifact].[ext]"
                ivypattern="${ivy.lib.dir}/[conf]/ivy.xml"/>
        <ivy:buildnumber organisation="${ivy.organisation}"
              module="${ivy.module}" revision="1.0" defaultBuildNumber="1"
              resolver="stage" />
        <ivy:publish resolver="stage"
              pubrevision="1.0.${ivy.new.build.number}"
              status="milestone" overwrite="true" update="true">
            <artifacts pattern="${lib}/integration/[artifact].[ext]" />
        </ivy:publish>
    </target>

What this does is first retrieve the "dependencies" (the artifacts we're interested in) specified in the ivy-publish.xml file to lib/integration. Then, it turns around and publishes them, changing the status from "integration" to "milestone".

Works like a charm.