I think the right approach would be to use the TWAP Safe that we used last year, but with a slightly different security mechanism. Instead of three complex signers, we should use a Zodiac module with only permissions to TWAP and send to the cold wallet.
The registrar could sweep to the safe, stewards could monitor a TWAP, and the only egress would be USDC to the cold wallet.
With ETH coming in and USDC going out, this just needs to be a continual time weighted process.