Okay, news: successfully hijacked the wifi update, I could send update files via the built-in Sync!
It was basicly a test KoboRoot.tgz zipped, containing only one file /mnt/onboard/list.txt to see if it works.
And it does. Kobo downloaded the file from my webserver, unzipped and did the update. The list.txt appeared on the USB mount. Also, if I select "Update Later", the KoboRoot.tgz waits for the next restart in /mnt/onboard/.kobo, as it should.
This also needs a libnickel patch to work, by the way.
Expect more updates on topic in the near future!