Can a revocation certificate for an old X.509 certificate be attached to an email in addition to a replacement certificate in such a way that the client user does not have to manually intervene? Or would the respective CA have to set up a CRL or OSCP server?
In X.509, all revocation goes through objects signed by certificate issuers. The decision to revoke or not revoke is not in the hands of the certificate owner, but of its issuing CA. The CA makes its decision known by including or not including the target certificate serial number in the CRL it produces (ditto for OCSP responses, which are just CRL with a scope reduced to a single certificate).
S/MIME relies on CMS (formerly known as PKCS#7) for the format of signed and/or encrypted emails. CMS can embed arbitrary "helper objects", including CRL and OCSP responses, if whoever assembles the message thinks that these CRL or OCSP responses might be helpful to recipients for the certificate validations they will perform. This can be used in case the CA does not have a reliable way to push its CRL in a place where the recipient will be able to grab them (a relatively rare scenario: people who receive emails often have an Internet access). Nevertheless, these CRL or OCSP response must necessarily come from the CA (or an entity to which the power was delegated, e.g. an OCSP responder).
In the X.509 model, everybody is assumed to be able to obtain fresh CRL or OCSP responses (and they should reject certificates if they cannot). In S/MIME, the sender's certificate is included in every email he sends, and recipients are supposed to automatically record the received certificates; when they respond, their tools should pick up the newest known certificate (after validation with revocation check, of course).