What is a goldcard and how does it work?
To partially answer my own question, the CID is a unique identifier assigned to the SD card at manufacture time. It is stored in a special register which is accessed using the SEND_CID command. From page 93 of Part 1 Physical Layer Simplified Specification:

The Card IDentification (CID) register is 128 bits wide. It contains the card identification information used during the card identification phase. Every individual Read/Write (RW) card shall have a unique identification number.

The CID therefore does not change when the card is formatted, and will be reported the same regardless of which device the card is plugged into.
The card does have an MBR partition table, and the Goldcard image is inserted into the code area of the MBR (between 0x000 and 0x1b7). There is therefore no direct interaction with the FAT32 filesystem. The first 128 bytes of the image are null however, and so it doesn't seem to actually be executable.