Had you thought about mounting certain areas as read only? For example, /etc, /local can be mounted as read only. When you want to make changes, such as installing a new package or whatever, just remount the file systems read/write. You can also use jails.
Timothy
