then take the output of wyBuild and add wyUpdate.exe and client.wyc back into the the release I just prepared (somehow busting open the signed bootstrapper and MSI in the process)?
No. Build wyUpdate / client.wyc before you build your update. wyUpdate only needs your version number -- it doesn't look t your files at all (that's wyBuild's job).
Does that make sense?