I am able to add a hook to the repo on sf.net to prevent commits outside
a specified subdirectory for certain users.

But this would still leave the other aspects you mentioned, so I would
recommend applying the usual criteria for allowing push access, e.g. a
track record of being active in Roundup development instead of just
being a one-time contributor.