There should be no updating unless enabled <...> and never nag the user.

I disagree, at that point you might as well continue using Win10. Security updates are the #1 reason to do this. Most computer use nowadays is networked (actually in a browser), and it's super important we keep that updated.

If updating is turned on, it should be very conservative, updates hand curated by grandmasnixos, basically never uses software that hasn’t been proven rock solid for at least 6 months

Eh, this sounds like a lot of work. Probably just use the stable channels, and only manually test when switching to a new stable channel.

Rolling back any update should be one-click-trivial

Agreed, should also be very obvious (like a label on the desktop that says "Issues after update?" and gives you a button to roll back and reboot)

The desktop environment should be something occasional win10 using grandma will not get lost in

This is the main question IMHO. I've not used any DEs for a while, so don't really know which one would fit this best while also being simple and robust.