I can't say we've ever gone to any lengths to prevent it - as we simply don't do it. Or worst case scenario (the underpant elves changed your core code) - you see it on the next Git commit that you issue.
But I guess there is a few ways to clean up/prevent it happening. So just to elaborate on your bullet points.
Identifying changes is fairly easy, just download a clean equivalent release and perform a
diff on the respective directories.
diff -r ./app/code/core ./clean_mage/app
You can find a more more guidance in the Magento debugging answer.
You could prevent edits to the core just by altering file permissions, make them read/execute only
chmod -R 555 ./app/code/core
Or go a step further and make them immutable
chattr +i -R ./app/code/core
Undoing modifications in real-time
If you are using Git, and your core is under version control, you could add a hook just to checkout the core prior to a commit
git checkout /home/path/public_html/app/code/core
Its a last resort really. The PHP include path (its not a Magento thing) will prevent you from being able to declare the same class twice.
Local > Community > Core
So the moment you add a class to
local, the respective matching file won't be read from anywhere else. So you need to copy in the whole file contents.
abstract/final classes - you don't have much of a choice, but for most other tasks, you can usually rewrite the class and bundle it into a module in