image directory path seems to be ignored in CiviMail editor
Ok, I've worked it out.
And it turns out that there is a location where CKEditor settings can be configured, namely at civicrm/admin/ckeditor?preset=default.
(Through the GUI it's at "Administer" -> "System Settings" -> "Display Preferences", then click the "Configure CKEditor" button towards the bottom.)

There are a few hitches on the way and perhaps this comes in useful for someone else down the track:


the image directory must be called images for the CiviMail browser to work with it;
the image upload directory setting in CiviCRM needs to point to the parent directory of that images dir; in my case it is [cms.root]/sites/default/files/;
the setting to override in the CKEditor settings is ImageUploadURL, which also needs to point at the parent dir of images. A local path works - I used /sites/default/files.
turns out that that alone didn't do the trick (I could browse the correct directory, but the browser would then return the wrong URL string); I also needed to override the setting in civicrm.settings.php like so (look for $civicrm_setting to find the examples):

$civicrm_setting['URL Preferences']['imageUploadURL'] = '/sites/default/files';


And that's it!

Now for this naming requirement.

In my case, we have been keeping all our images organised in a directory called uploads, and the image browser clearly had a problem with symbolic links. So what I did is

mv uploads images
ln -s images uploads


Aka rename uploads to images, then create a symbolic link named uploads. Then reconfigure IMCE in Drupal to now use the images folder. (It seemed to keep working just fine with the symbolic link, but we want to keep things clean.)

NB: In my case, the site is hosted on a cPanel with no ssh access, so I did the renaming through the GUI and then created a cronjob to run the second command (here at 19:45h, and don't forget to delete it again) like so:

45  19  *   *   *   ln -s images /path/to/drupal/sites/default/files/uploads


As a result, all images now live in $drupaldir/sites/default/files/images and both, IMCE in Drupal, and kceditor/ckeditor/whateveritis in CiviMail, now work with it, referencing the same files. Yay!

Meanwhile, Apache seems happy to resolve across the symlink, hence all existing URLs keep working, though it'd be nice to clean them up over time.

(Not a straight-forward search/replace through the database, unfortunately, as the two strings have different lengths. If they were the same length, that'd be simple.)