Interesting; I'm curious why you see value in specifically making some kind of commitment, in case of already-exposed P2PK outputs. In our imagined example, if Satoshi is going to make a commitment, thus actively doing something on the network, why not just spend the P2PK into a new hash-covered output instead (to a p2pkh now or a QR output if it exists)? This has the advantage of not requiring messy new protocol rules, until later.

But one detail in your scheme: let's say we have a Satoshi output in P2PK U1 with pubkey P1. Satoshi can publish a merkle tree or similar with a tx TX1 that spends U1. Let's say, today. I think it's necessary to tease out what stops an attacker from doing the same with TX2 spending from U1, yesterday. If the attacker does *not yet* have a quantum ECDLP break, then we have defence from the transaction being signed (as long as we don't use txid as defined in bitcoin, as the hash - which doesn't include the witness! That could be an oops). The attacker can create TX2, but not sign it. Of course if the attacker *already* has the ECDLP break, then why wouldn't he just steal U1 right now, so *maybe* that's OK. But this is all extremely tricky.