There's probably a way you can just set it and forget it with overlayfs.

OpenWRT solved the problem of updates via immutable firmware image flashing while maintaining customizations 15 years ago using it.

Probably! At the end of the day, this is the only change I need to make, and the updates are fairly infrequent, so this solution is good enough for me. I only brought it up as an example of how even the meta-rules around how sudo rules are interpreted might be more complex than people realize.