In case anyone is interested, I have improved upon the fully verified immutable Linux OS image approach I described in the first post. It now supports booting into three separate boot modes; normal boot, maintenance mode and reseal mode. This way it is possible to make software or configuration changes, such as installing security updates, while in maintenance mode, and when booting into reseal mode the Secure Boot signing keys are obtained from the TPM2 chip, protected by a PCR register so an attacker can never access them.
Installation scripts and instructions as well as technical details are available here as a proof-of-concept:
As for how to port this to QubesOS context, someone else posted this a while back: