You could mount /etc and /usr as read-only, and have the upgrade process briefly remount it read-write. Then you won't accidentally edit something, it will be very obvious that there is a reason for that read-only mount...