I wonder if any free certificate issuers still support Must-Staple?

I don't think so.

- Let's Encrypt: doesn't support it since May 7 this year

- Buy Pass: No longer offers free certificates, probably didn't have must-staple either

- Zero SSL, I didn't find any public links to check if they sign CSRs with it.

- Google Trust Services: Same as above

- Amazon Trust: Same as above, but it probably does.