puppet agent could invoke special file triggers when important files are modified.

For example, I've described one case like this in a manifest:

    file {
      "/etc/resolv.conf":
        ensure  => present,
        content => template('apipkg/dnsmasq/resolv.conf.erb'),
        notify => Exec['update_chrooted']
    }
    exec { 'update_chrooted':
      command     => 'update_chrooted all',
      refreshonly => true,
    }

puppet agent could have had built-in triggers for such files. Perhaps, invoking the triggers from /usr/lib/rpm/*.filetrigger would also make sense.

The tricky thing is to do this not very often and not very late: after a group of files is modified, but before any other action (so that there is no attempt to use the modified files).