In the transaction's version field, what values are legal?

The version field is a 32 bit unsigned integer, any value is valid. Version 0, or version numbers above the nodes CURRENT_VERSION constant are considered non-standard and are not relayed, though they can appear in blocks.

What values have actually been seen in the blockchain?

1 is the only number to have been in use at this point in time. BIP62 proposes bumping the version to 3 (skipping 2 entirely) to match the block version and avoid confusion, however this was withdrawn. BIP68 specifies that transactions spending a CSV output must have version 2 or higher.