Well, after a few hours of hacking on startup scripts, the answer is really very simple. Lock the file. I was a little afraid of doing this, not knowing how the Windowserver would behave if it couldn't write its own plist. Turns out, it will, as long as the file is not locked. Locking the file involves setting the immutable bit while the file is read-only.
Setting the bit for immutable on the file is reasonably simple to do, however it does require some preparation and specific steps to make it work. Let me know if any of this is unclear or needs further detail:
1. Log in as the user that you want to lock the screen resolution down on. If you have multiple users, you'll want to repeat the first couple of steps for each user. If you do not, they'll get locked to whatever their last resolution was before you lock down the preferences.
2. Set the screen resolution/colordepth/refresh rate as desired. Repeat this for each user on the system that you want to prevent changing these settings.
3. Issue the following 2 commands while logged in as an admin user:
sudo chmod 444 /Library/Preferences/com.apple.windowserver.plist
sudo chflags uchg /Library/Preferences/com.apple.windowserver.plist
4. Reboot. This may not, strictly speaking, be required, but it does set PRAM to the current screen resolution. This will prevent screen flashes during boot while the windowserver comes up and resets the display.
5. Enjoy. The users can change resolution for their current session, but as soon as they log out, it will be reset to whatever has been locked in. This also applies to reboots.
To reverse this behaviour, issue the following commands:
sudo chflags nouchg /Library/Preferences/com.apple.windowserver.plist
sudo chmod 644 /Library/Preferences/com.apple.windowserver.plist
Standard disclaimers apply to all of this - I'm not responsible for any damage to the system that you experience by doing any of this. I will, however attempt to help if you get stuck.
Also, if you change the monitor attached to the system, you should unlock the preference file before doing so. Most modern monitors should be able to deal with the resolution and refresh that you mention earlier, but you never can be too sure.
Good luck! Let us know how it works for you.