Get a developer key and install Unbuntu on a usb disk so you can boot any XO from the USB disk without modifying your XO laptop. All production XO laptops have firmware security enabled when you receive them. Once unlocked, you can run any operating system you want.

There’s no need to unmount it or mount read-only before adding the journal. If you operate on a mounted file system, the journal gets created on a regular inode. Upon your next boot, the journal will be moved to the hidden inode. You can’t modify or remove the .journal file either, so don’t even worry about that.