What would happen to Bitcoin in this scenario - whether through quantum computing or someone coming up with a fast enough way to reverse the 'one-way' function that calculates the public key from the private key (which, if I'm not mistaken, uses elliptic curves and SHA256)?

This is not the same problem as just cracking SHA256 for the purpose of mining; that could pose a threat of a 51% attack, but from what I understand that's more of a DoS thing than a theft threat and it could easily be solved by forking and switching to a different hash function.

If someone found a way to calculate private keys from public keys, however, they could access your wallets and steal your coins. I imagine we'd want to replace that [no longer one-way] function with one that's harder to crack and migrate wallets from the old chain to the fork (which would require the owner to generate a new key pair). But in the meantime thieves could steal your coins. Whatever coins they stole, we'd have a good reason to reverse those theft txs. I understand the idea of reversing txs is not popular in the Bitcoin community, but in this case it would be justified, because the security of the network has been compromised and something needs to be done about it; we don't want people to lose coins through no fault of their own. How would it be decided which txs to reverse? A cut-off by broadcast time wouldn't necessarily work, because some txs broadcasted after the first theft tx may be legitimate. Of course it would be reasonable for people to stop transacting when they find out security has been compromised, but the news about the incident might take time to reach every user.