I would rather keep the WordPress php files and directory owned by someone other than www-data, and leave them read-only to www-data
Well, why not? Just do it, but after it subscribe by hand to any (from at least two) channel of “Release Notification” (low activity, еasily controlled even by the eyes): mail list or RSS-channel on official site for category “Releases”. With these notification you can:
- login to host with site
- return permssions|ownership
- perform “classic” WP-update
- rollback ownership|persmissions to “strict RO” state
- Be happy until next release will be releasd
From other side, you can get some automation around ML-messages|Feeds and, having SVN-controlled WP blog, run subversion’s update not in cron (wasted time and resources in 99% runs), but on demand (howto on this topic is offtopic here, ask on SuperUser|WebMaster|StackOverFlow)
When you’ll convert your current blog into SVN-managed and there will be an event “New Release”, launched (have to be written around my dirty idea) SVN-updater can detect latest release rather easy (and switch WC of blog to it): in noted by you “Installing/Updating WordPress with Subversion” article it’s just
cd blog
svn sw https://core.svn.wordpress.org/tags/4.7.3/ .
where 4.7.3 is the right version, you just have to get changing “The Right” version semi-automatically. Well, let’s se at URL in command and on output of one more SVN-command (used on live WP-core repo)
>svn ls https://core.svn.wordpress.org/tags/
1.5/
...
4.7.3/
latest string is always the number of latest WP-release (ok, release with greatest number, technically speaking). For good OS with good shell “last string of svn ls” output is just svn ls <URL>|tail -1 and you have target, on which you have to switch
Final note:
Also, the last step in an svn update is to visit wp-admin/config.php with a web browser
No. According to the same page in Codex as above noted
Run the usual wp-admin/upgrade.php and you’re done
and this task can be (not tested!!!) executed without client’s browser by calling f.e. CURL with URL in server’s console (duty of the same SVN-updater script)