I guess you can avoid draining by miner by enforcing zero fee: require the non-covenant input to be dust amount (the same amount as output_1), and then the transaction will need to be paid for by CPFP using the dust-paying output.
There could also be other complications on the ‘complete withdrawal’ phase, but I did not analyze it yet