What I'm hoping for is some way to get a "CentOS 3.10", being 3.9 with the vault updates directory contents merged in.
Is there a straightforward way to do that, or is schlepping around folders full of RPMs actually the best way to go?
Yes, it can be done. I did it a while back, but don't remember all the details.
I merged the updates into the distribution, plus a few yum-related packages from centosplus. I *think* I hacked up a comps.xml to create the yum metadata with createrepo, but that's only half the story. You also need to update the hdlist and hdlist2 files with /usr/lib/anaconda-runtime/pkgorder and genhdlist. There are pitfalls. Best thing is to build a 3.9 vm from just the base package and then create all the metadata files on it from the combined repo.