I realise that this is an old post but I have done the same thing and come to the same conclusion that JTAG-Enable TCK and TMS all run to ground.
Taking this a step further and in the hope of being able repair this by cutting a few traces I decided to remove the chip from a second board and proceeded map each JTAG wire from the top of the chip to the balls underneath (unfortunately I could not find a datasheet for this chip and spent hours with a sewing needle taped to my multi-meter probe)
The result were as follows
JTAG-Enable TCK and TMS are attached to each other beneath the chip and then to ground
TDO is not attached to anything
TRST_N can be found on the bottom of the board beneath the chip
TDI can be found on the top of the board to the right of the chip
I think it is therefore safe to say that this box cannot be modified. (please prove me wrong)
The attached picture shows the pin outs on the SMP8634LF chip and also traces connecting JTAG-Enable TCK and TMS
apologies for the late response ! been distracted by child rearing unfortunately - guess things have moved on to other boards by now.
your disassembly looks conclusive to me - i dont think theres any way to get to those signals with the chip attached to the pcb unless you can add some tracks and then reattach your smp. out of scope for my soldering iron !