Proof: By Dirichlet prime number theorem, for every $N$, there is a prime $q$ of the form $q=(N-1)+kN$ as long as N-1 and N are co-prime, which is true whenever $N>2$. Then $N|q+1$and the solution by UnexpectedValues can be used with appropriate $p$. Such p exists whenever $q>2$which is always the case for $N>3$. For $N=3$, one can take e.g. $q=5$ (since $3|5+1$). And $N\le 2$ is trivial.

Note that your approach only works for target $N>3$ (that is $q>2$), as $p^2+(1-p{)}^2=1/3$ does not have a real solution. Open question: How about 1-coin solution emulating a 3-sided dice?

See my solution (one long comment for all 3 puzzles) for some thoughts on rational coins - there are some constructions, but more importantly I suspect that no finite set of rational coins without the 1/2-coin can generate any fair dice. (My lemma does not cover all rational coins yet, though; see by the end of the comment. I would be curious to see it turn out either way!)

The first puzzle got me into an optimization mindset -- and it seems to be the right mindset for that problem -- but the optimal solutions to P2 and P3 (which I missed before reading spoilers) are "crisp" or "a neat trick" rather that a result of whatever matches a (however clever) "optimization process" for me. (If this was intended, I really appreciate the subtlety of it, Scott!)

By "optimal*" I mean definitely cheapest formulas among all formulas using only natural numbers smaller than ${10}^{1000}$as intermediate values (and modulo any bugs in my code). You can find the code here and the solutions for all numbers 1..10000 here (obvious spoilers).

The largest intermediate value needed for all of those is below ${10}^{220}$. Note the code also finds optimal* formulas for many more values (~100 million on 50GB RAM), just does not report them by default. 

I have ran the code to also consider intermediate values up to ${10}^{10000}$ and even ${10}^{100000}$ and did not find any cheaper solution for numbers up to 10000. (In those runs my code got to the optimal solutions for only 98% and 88% (respectively) of the numbers up to 10000, not finding any better solutions, then ran out of memory. I still consider it a good indication that much larger values are likely not useful for numbers up to 10000.) I would be really interested in constructions or intuitions why this may or may not be the case!

I know about at least one case of a formula using real numbers as intermediates that is (very likely) strictly better that any formula with only natural intermediate values. That example is due to Scott -- leaving it up to him to disclose it or not.

2021 = (isqrt(isqrt((isqrt(isqrt(isqrt(isqrt((2 ** fact(fact(3))))))) // 2))) - (3 ** 3)) -- a cost-108 variation on $2^{11}-3^3$ that uses a clever cost-12 formula for $2^{11}$. This uses $5.5e216$ as an intermediate value -- the highest (up to small variations) encountered in formulas for values under 10000. This sub-formula is used in 149 of the 10000 solutions. My code prefers solutions with the smallest intermediate values used as a secondary criterion, so these large intermediate values are necessary for optimal* solutions.

Other encountered sub-formulas using large intermediate values: 7381 = (fact((2 + fact(5))) // (2 * fact(fact(5)))) (needs $1e203$, used 10 times in 1..10000), 3782 = (fact(((2 ** fact(3)) - 2)) // fact((fact(5) // 2))) (needs 3e85, used once), 1189 = isqrt(((2 // 2) + (fact((fact(3) ** 2)) // fact((2 ** 5))))) (needs 4e41, used once), and 32768 = isqrt(isqrt(isqrt((2 ** fact(5))))) (needs 1e36, used 56 times). All other optimal* solutions for values up to 10000 only use intermediate values smaller than ${10}^{10}$.

The distribution of used intermediate values -- only 3 between ${10}^{10}$ and ${10}^{100}$, 2 more under ${10}^{300}$, and no more under ${10}^{100000}$ -- is my main argument for all the found solutions for 1...10000 being likely optimal. Anything to the contrary would be intriguing indeed!

$N=-{\log }_2{\log }_2\sqrt{\sqrt{\dots \sqrt{2}}}$ using $N$ nested square-roots.

After 2 dice rolls of $dA$, $dB$, partition the $AB$ outcomes into $N=2022$ equally-sized sets, and $C=AB\text{mod}N$ remaining outcomes. If you hit one of the $N$ sets, you are done. If not, you can use the remaining information as already having thrown a $dC$ and only throw one additional dice (if C>2) before you do another partition of the outcomes into $N$ sets and a remainder (rather than doing a full restart). (Note that it is generally better to be left with a larger $C$ when the probability of spillover is comparable.)

This can be represented by a recursive formula for ${EAR}_N\left(A\right)$: "expected additional rolls if you already have thrown dA", the puzzle result is then ${EAR}_{2022}\left(1\right)$. Rather than the full formula, here is a program that iteratively computes $EAR$. My result is $2.0000005791099$, matching other similar solutions here. (See Vaniver's comment for the optimal one)

There are some reductions between coins and emulated dice. (Note $d1$ is trivially available.) 

• Reduction 1: If you can emulate $dA$ and $dB$, you can emulate $dAB$ (trivial).
• Reduction 2: If you can emulate $dA$, you can emulate dice of any divisor of $A$ (trivial).
• Reduction 3: If you can emulate $dA$ and $dB$, you can emulate $d(A+B)$ with additional $A/(A+B)$-coin (flip the $A/(A+B)$-coin, then emulate $dA$ or $dB$). In particular, you can emulate $d(A+1)$ using $dA$ and one extra coin.

This then gives a few solutions to 2021 using only rational coins and a range of general solution schemas to explore:

• Using $k$ different coins, one can emulate $dA$ where $A$ is a number with $k$ ones in its binary representation (start with 1, use R1 with $d2$ to append "0" binary digit and R3 to add "1" binary digit) as well as all its divisors (R2). 2021 divides $68987912193=2^{36}+2^{28}+2^0$, we use 3 coins: 1/2, 1/257, 1/68987912193. (One can look for low-binary-1 multiples of a number with binary residuals and some branching.)
• Find $a,b,c,d\ge 0$ such that $N|2^a{3}^b+2^c{3}^d$ (3 coins) or $N|2^a{5}^b+2^c{5}^d$ (3 coins, 5=2^2+1) etc. 2021 divides $2^{10}{5}^{27}+1$.
• Yet another solution for 2021 is to go from needing $d2021$ to $d2020$ via a $1/2021$-coin, then to $d505$ via $d2$, then notice that $505|2^{50}+1$. This also implies some possible schemas.

I don't know about a fully-general (and guaranteed to halt) algorithm using just R1-R3, since it is not clear how high you need to go in the multiples to split via R3. There may also be other reduction rules even for just rational coins. I would be curious about any thoughts in that direction!

• For any argument, you can assume any schema is "static": it throws a fixed sequence of coins regardless of intermediate results. (Proof: Take an arbitrary decision tree with its leaves grouped into $N$ groups of equal probability. Inserting a new coin-flip anywhere in the tree (branching into two identical copies of its former subtree) preserves the resulting groups-distribution. Obtain a tree with single-coin levels starting at the root.)
• Any finite set of rational-probability coins of the form $p=a/b$ with $a$ natural and $b$ odd (i.e. without a 1/2-coin) can't emulate any dice (proof via expansion of all the probability terms with a common denominator in a static decision tree; exactly one of these terms is odd) (a simpler proof shows this for single rational $a/b$-coin for $a/b\ne 1/2$ using binomial expansion of $(a+(b-a){)}^k/b^k$).
• Therefore using only rational coins, the only 1-coin-expressable dice are $d\left(2^k\right)$. I suspect that the only 2-coin-expressable dice are divisors of $2^a+2^b$ for some $a,b\ge 0$.
• Any set of coins with transcendental and algebraically independent probabilities (i.e. numbers that are not roots of any multi-variate polynom with rational coefficients, e.g. $\{e,\pi \}$) can't emulate any dice (proof using the "not-roots-of-any-rational-polynomial" definition on the expansion of leaf probabilities of a static decision tree).