This is a placeholder until I finish writing more details, but I want to refer to it from code.

The short answer is some rpath hackery in the pure CoreFoundation and some careful hooks.