I'll begin by noting that your question's content indicates a clear understanding of (what I at least consider to be) best practices.
Regarding the potential multiple versions of origin: the goal of a software upgrade is to have the new classes and methods in place, period. That means (as you mentioned) porting any customizations regardless of how they were implemented.
Outside of diligent diff'ing, the best technique for your situation unfortunately will be regression testing - checking the generated output for multiple views.
It could very well be the case that you may need to punt, i.e. start with a clean install and actively bring in the custom functionality & theming which is still deemed necessary. This may not seem like the most efficient approach, but here are the benefits which I believe outstrip the apparent overhead:
- You will be in control of all custom behavior with no surprises
- You will be assured of a healthy codebase of single origin
- At some point to the client you become the owner of the code, and a whitelist/affirmative approach to reintegrate customizations seems the best way to be sure that your ownership is what you expect.
