I'm only sharing our experience and approach, not arguing in any particular direction for the CS&S distribution, especially given that our approach is optimized for our "hosted-multi-user" use case.
We actually dropped extension support a while back in favor of either integrating features into core or making them API clients/integrations. Prior to that we did implement API versioning, support for multiply versioned GREL runtimes and two SDKs as new surface areas for integrations. This allowed us to keep the internals (and most importantly dependencies!) free from integrations, it was a complete game changer for maintenance of "core".
It might be tricky for the CS&S distribution given local installs but maybe it could be possible if there was some broker protocol in place?