So, I see the following options (other than adding mail filters which simply delete these things on my side):

1. Remove root@ from the list of owners -- which presumably means root@ can't help with admin tasks for these mailing lists anymore

This should be done.

2. Copy the owners - excluding root@ - to the moderators so the flow to root@ stops

This should be done too.

3. Forcibly set mailing lists to drop non-member posts - the current default seems to be to hold for moderation

I don't know if it can be readily done, but I like how Google Groups work: trusted emails can post to any group without needing to subscribe (which is only for receiving emails from the list). For c-l.net, that could be the list of emails registered in the Gitlab instance, and possibly the list of emails subscribed to other lists as well.

Another idea is to automatically drop messages that are in the moderation queue for more than 365 days. I believe Mailman 2 used to do that.

Additionally, we could archive (remove submission possibility) for mailing lists which haven't received a single post for more than 5(?) or 7(?) or ... years.

I don't think this is necessary.