Thanks Stewart. After a lot of Google searching, I came across another thread explaining how to do it. I was overthinking it: Manual editing of the predial hooks is not needed; it can be configured using the FreePBX Web interface. Then I noticed that the author of the reply in the other thread is… you! 
So thanks a lot for that.
For the benefit of anyone who comes across this thread, here is the other thread:
And the key response from Stewart, which worked for me:
Without any custom dialplan, if I set both ‘Send RPID/PAI’ to be ‘Send PAI header’ and turn on ‘SendPrivateCallerIDinformation’, then when I set the display name for the Outbound CID for my extension to “hidden”, then FreePBX:
- Puts ‘anonymous’ in the From header user field (you could override this if your provider requires an account number, etc. there).
- Adds a Privacy: id header
- Sends PAI with the display name “hidden” but the number sent normally.
By the way, your point regarding calls without a valid caller ID is well taken. Blocking seems to happen more on long-distance calls at the carrier level; local calls seem to go though fine, at least in my area with my very limited testing. I actually don’t have a real need for this feature; I’m a home hobbyist and I did it for the challenge of replicating POTS *67 service.
Thanks for your help!