I did get it working to some part. I prepared a file system with telnetd enabled and the httpd without (presumably) "security" checks (option -f), and some flash tools (fw_printenv, flashcp) added.
This is a very crude try, but I can share the image if you want.
Where I'm stuck now is that uboot is using default environment settings, so I cannot change them as I planned (fw_printenv/fw_setenv). The httpd seems to stricktly check flash partition sizes, which we have at [...]1024k(uImage),6976k(rootfs)[...]
Here I'm stuck currently. Just flashing from uboot via tftp does not really help, as you would need to open the box and attach the serial console cable.
Next try is mangling the image to contain splitted lede build with 1024k 6976k fragments.