so anyone changing Jenkins job configurations can alter critical httpd rules,

Anyone who can alter Jenkins jobs can do trouble either way. Anyways, seems we agreed on .htaccess for a while now, so no need to fight about theoretical issues with the alternative

you also can't have a Jenkins build job to perform anything locally if it's running on a slave,

I meant to have a script running on the server, e.g. using inotifywait, which listens for changes to the config include rsync-ed to the server. No need for any other Jenkins jobs.