How do I prevent Plugin updates from clobbering user edits?

Don’t allow your users to add files or edit your files.

Instead, use things like do_action and apply_filters like the WordPress core does.

I’m not familiar with GeSHi, but I would suggest you figure out where in the class it loads the file required for the language. Modify the file path so it looks something like this:

$file_path = apply_filters( 'yourplugin_name_geshi_path', $file_path, $lanuage );

Then users could hook into it and modify the file path accordingly…

<?php
add_filter( 'yourplugin_name_geshi_path', 'wpse27248_path_modify', 10, 2 );
function wpse27248_path_modify( $path, $language )
{
   if( 'some_language' = $language )
   {
      $path="/some/new/path";
   }
   return $path;
}

Your best bet is probably to create a Subclass of GeSHi, modify the methods you need to modify (as suggested), and use that class for your plugin. If GeSHi updates, you can drop in the new version without loosing your changes.

No having to worry about overriding user files or anything else. Users, if they need a new language in the library, can just create a very simple plugin of their own.