I discovered why MathApp would not run as a smart client unless you gave it LocalIntranet permissions: I was setting the Active property of the form. This is presumably not allowed for Internet zone apps because in the case of a control it would be grabbing focus and possibly compromising the code in the surrounding form.
This MathApp should run from the Internet zone without any special configuration (as long as you connect to the MathService XML-RPC service at EraServer).
This MathApp will run but all math requests will fail unless the app is given at least local Intranet zone permissions. There is no MathService running at CookComputing.com and Internet zone apps are not allowed to connect to servers other than the server they were downloaded from.
I also had to make a change to the CookComputing.XmlRpc.dll assembly by giving it a strong name and adding the following obscurely documented attribute (from the System.Security namespace):