A final update: the implementation is now up as a ready-for-review PR:
The final design is the per-admin opt-in approach described above rather than the site-wide enum I originally suggested.
A couple of UX details were added during the final pass:
the per-admin preference is shown under Preferences → Interface when the site-level gates allow it
when an opted-in admin permanently deletes the first post/topic, the irreversible confirmation now explicitly says that it will permanently delete the topic and all replies
when the admin is not opted in, the existing behaviour and wording remain unchanged
the existing same-admin permanent-delete cooldown is still enforced
preference changes are recorded in Staff Action Logs
I also manually tested the complete opted-in path on a disposable topic with two replies and verified afterward that the topic and all of its posts had been removed from the database.
The main GitHub test/lint checks have passed; the PR is now waiting for review, with the security scan still queued at the time of writing.