04, 05, 06 for basic EDACS operation.
12 and 29 for ProVoice. (12 might not be needed, not sure about that)
You know, I'm not exactly sure what features need to be installed for EDACS operation; I have a couple radios that don't have 05 or 06 and they work fine. Every radio I've bought so far has had 04 installed, but you really do want that since it is group scan.
You don't need option 12, as that's for AEGIS, but I think any radio that can run ProVoice, has the hardware to do AEGIS, it just has to be flashed for it. You do need the magic option 29 in the radio for sure.
You will also need a good understanding of the system setup, ALL the LCN's, their order, and any neighbor sites. You will need to find a LID that is not in use to avoid causing issues if they try to ping the radio for ProFiling/location detection.
Setting up a radio to monitor these systems is not for the faint hearted. It can be done with the proper hardware but expect to spend ~$500+ on a radio, $100 for the programming cable, and then you need to get the software to actually program it, which last i knew, was about $2,500. Easiest option would be find someone in the know and have them help you to keep yourself out of trouble.
You're right about a lot of this. I would say that the programming is not for the faint of heart, if you're a beginner. Once you've done it a couple times(successfully), it's pretty straightforward. The question is, are you going learn by trial and error and possibly get your radio zapped by a system admin or worse yet, cause disruptions to a public safety system? That said, EDACS systems are extremely easy in getting a radio to listen in, without it actually logging on or letting anybody know it's there, and this can all be set in the software during programming.
In response to andyishere's question about legalities, here's the deal as far as I understand it. Even though you can render an EDACS radio incapable of transmitting or logging onto a system, by the letter of the law, you would still have public safety frequencies that you are not authorized for programmed into the transmitter, and here's why. An EDACS 800 MHz radio operates within a bandsplit, meaning the transmit frequencies are 45 MHz lower than the receive frequencies, and this is completely fixed and unchangeable. What this means as far as radio programming is concerned, is that when setting up a trunked system, you only enter the transmit frequencies into the radio, and the receive frequencies are automatically calculated. So technically, for the radio to work in trunked mode, you have to enter the transmit frequencies, even though you will never use them.
Now this can be gotten around, though it's significantly more expensive, but in a case like mine, unavoidable if you want to listen to a ProVoice/ESK system. If the system is employing ESK, then you can't even program the radio to listen to the system. You can still monitor them using the Digital Voice Conversion Method described in the wiki, and this would be completely lawful, because in that case your ProVoice radio is programmed with a single conventional channel, receive only with no frequency entered into the transmitter so you would be in compliance with the law in this case, as per my understanding. But that project is quite an undertaking if you are serious about it.