I got this to work using an adjustment to Kristoff's code.  

The biggest difference is how the image tag is constructed, specifically how the src is built and passing in the sys_id.

Here is my complete solution: 

(function executeRule(current, previous /*null when async*/) {
	// check if tag is found in body
	if(current.body.indexOf('[embedded report]') == -1)
		{
		// if not found, leave everything alone
		return;
	}
	// get email attachments and set them to inline attachments
	var attach = new GlideRecord('sys_attachment');
	attach.addQuery('table_sys_id', current.sys_id);
	attach.addQuery('table_name', 'sys_email');
	//attach.addQuery('attachment.content_type', 'STARTSWITH','image/'); // only images supported
	attach.addQuery('content_type', 'STARTSWITH','image/'); // only images supported
	attach.addQuery('email', '=', current.sys_id);
	//attach.addQuery('sys_id', 'sys_id');
	// set any attachments as being inline so they aren't attached
	attach.setValue('content_disposition', 'inline');
	
	attach.updateMultiple();
	// get the attachments to loop over
	attach.query();
	// if
	if(attach.getRowCount() == 0)
		{
		gs.warn('No attachments, so nothing to inline');
		current.body = current.body.replace('[embedded report]', 'Nothing to attach');
		return;
	}
	var reportContent = '';
	// add tags to inline all the images
	while(attach.next())
		{
		reportContent += '<img id="img_{id}" alt="{alt}" src="sys_attachment.do?sys_id={sid}"'
			.replace('{id}', attach.file_name)
			.replace('{alt}', attach.file_name)
			.replace('{sid}', attach.sys_id);
		}

	// replace the tag in quotes since that can't have tags added to it.  This should be a smarter regex, but we'll brute force it for now
	current.body = current.body.replace('\'[embedded report]\'', '');
	current.body = current.body.replace('"[embedded report]"', '');
	// add the image tags
	current.body = current.body.replace('[embedded report]', reportContent);
	return;
})(current, previous);