What would be the architecturally-right place to put custom -D defines?
That is a tough one...  Because arduino-builder is basically a custom go script you don't get the facilities you get in a Makefile, like shell execution. 

I would be inclined to do this kind of thing outside that environment - use some external program or tool to generate a config.h file (maybe use something like GNU Autotools) that contains your custom defines. That can then be #included in your sketch.