When I add custom config data I usually just make the default config file readonly to stop valve from messing with it lol.
As the autoexec, it will load up every time you open up the game, but I see what you're saying about making the cfg readonly.
4) Use admin privileges sparingly and appropriately.