To directly answer your question, #1 is the best option as it lets the user know when they have met the awesome password level, which is in theory the point. To address your point of well don't flash red when it isn't an error yet (I leave the field and you wont let me submit this if I don't fix it) then don't display the weak text in color, just leave it gray as help text might be, or present it as help text that says, it would be more secure to include a special character (Tell Me More). Reward me with color once I pass the magical strong password threshold instead of punishing me with the error.
You can then turn the weak text to red after I leave the field to reinforce that I should really change my behavior of using "god" as my password. You can either reduce this back to gray once I click in, or wait till I fix the error.
I would follow this all up with a question of my own though. Why are you rating the users password? If i use P@ssword1 its still a horrible password but most raters will say that's a strong password. None of these items increase security and in some cases, if you make me cause the password to be to complex I end up writing it down.
With current malware etc. password complexity isn't a great deterrent when the browser itself is infected and keylogging everything or allowing the browser to be remotely driven. None of which needs to be a targeted attack when it simply messages the hacker when you start logging into your bank. (Zeus, Spy Eye)
If your looking to improve user behavior, you would be better off checking for the top 20 commonly used passwords and their variations using special characters and nay saying those rather than blindly deciding that This!smypassword is a secure password because it is log enough, includes upper and lower case characters and a special character.
Just my thoughts on the matter.