The GUID is a unique identifier. That is its only purpose.
When it’s a post, I think guid is self-evident. But what is the
correct formulation/destination for that URL when it is an attachment?
Attachments are posts. If the GUID is being used then the attachment is being consumed from a feed as a post. If attachments are not being distributed in a feed then the GUID is not probably not being used either.
If it’s being used as a URL then it’s being misused, and the permalink should be used instead.
Should it point to the image file itself, or to the “post” page that
WordPress stands up to render images?
It doesn’t matter. It’s only a unique identifier, it doesn’t ‘point’ anywhere. The fact that it is a URL by default is merely the result of that being a shortcut method for creating a unique identifier, since URLs must be unique.
If it’s all personal choice as long as it’s unique, well, what is
WordPress’ default behaviour?
By default the URL to the attached file is used as the GUID, at least as far as I can tell.