How best to allow scripted source address in watchcat

My ISP has flaky support for prefix delegation for IPv6. It seems that if their router reboots, they stop routing the IPv6 prefix delegated to my OpenWrt router. But, they continue to route IPv6 traffic to the specific WAN address assigned to the router via DHCPv6. To fix this, I need to restart DHCPv6 on the WAN interface, and then everything works just fine until the next router reboot.

I want to monitor IPv6 connectivity from the delegated prefix, and thought watchcat would be just right: in the "run a script" mode, if the routing is busted long enough, my script will be called, it can restart the WAN interface (ifup wan6), and that will refresh the delegation and restore connectivity.

To do this, what I want to obtain the current LAN interface's address in the delegated prefix, and use this as the source address for ping.

In watchcat's config, I can't use br-lan as the interface, because that binds ping to the interface, not to the interface's current address, and thus the ping fails with Network unreachable (the LAN interface doesn't route to the WAN).

If I were just running the ping by hand, I would do something like:

ping -6 \
 -I $(ifstatus lan | \
      jsonfilter -e "@['ipv6-prefix-assignment'][0]['local-address']['address']") \
 -s 56 -c 1 <ipv6-host-on-internet>

But, currently (for good reasons) the watchcat config value for the source interface is not evaluated by the shell script in /usr/bin/ when it executes the ping command.

Opinions wanted: is it better to explicitly add support for a calculated source address to /usr/bin/ (Such as by an option that says bind to the delegated IP address of an interface, instead of just to the interface, when calling ping.) That would limit watchcat support to pretty much just this one use case.
Or, is it better to add support for evaluating (at the time of each ping invocation) a configuration value as a shell script? This provides flexibility for doing any sort of source address or interface calculation, but also the potential for configuration abuse via arbitrary command injection.

(Note that we can't evaluate the source address and cache it for the life of the script, we need to evaluate it before each ping, so it follows any IPv6 reconfiguration of the LAN interface.)