This is my concern:

But if you are in a single interpreter-constraints repo, then this is an unnecessary hit to perf, no matter how much we optimize.

Fundamentally, we should not be doing more work than necessary. And I'm not just talking about lockfile invalidation, this also applies to partitioning by ICs, determining the ICs for pex_from_targets.py, etc. No need to iterate over every target when we can simply look at a single global option

extra boilerplate/steps

I'm generally cognizant of that, but honestly not very worried here. All it would be is adding one line to https://www.pantsbuild.org/docs/python-interpreter-compatibility#using-multiple-python-versions-in-the-same-project to add

pants.backend.python.mixed_interpreter_constraints

to

pants.toml

, which is a one-time thing only done by the initial codebase admin