Answering my own question here...
Now that I understand how the files are stored on the file system, I've decided to CURL them via SFTP.
What I didn't get at first is the the key column in the ost_file is the actual file name as renamed by OSTicket upon upload and storage in the attachments folder. Using the original file name and file type as stored in the database, I'm able to pass my CURL function the calculated attachment file path, the name I want for the file, and the file type.