What are the minimum permissions for a Windows share to be anonymous-read only?

First, setting up anonymous access to a share isn't that bad, you just have to include Anonymous in Everyone (you actually linked to it yourself):

1. Open the Local Group Policy Manager (gpedit)
2. Computer Configuration
3. Windows Settings
4. Security Settings
5. Local Policies
6. Security Options -- Network access: Let Everyone permissions to apply to anonymous users from Disabled to Enabled
7. Change Network access: Restrict anonymous access to Named Pipes and Shares to disabled
8. Network access: Shares that can be accessed anonymously - set the share name there you are sharing.

As far as the Share itself goes then. Set the Share Permissions as "Everyone - Modify" and "Administrators - Full Control". Then set the NTFS permissions as Administrators - Full Control and Everyone - <whatever rights needed>

That should handle your need.