Thinking a bit more, I don't think I actually need to have a hard "never use SO" rule.
What I can do instead is, default SO to tristated / JTAG mode.
And in a few specific commands like "query bootloader flash status" enable SPI mode on that pin (resetting jtag in the process due to the errata) and then immediately return to normal mode.
It means that single-stepping through that part of the code won't work, but I'll still be able to reset or power cycle the chip and have JTAG functional again for flashing or debugging of anything but the bootloader.