Most of my changes now are in the payload, not in the coreboot components, so ideally I would not need to touch the top 4 MB chip at all. I can't figure out a way to ask CBFS to create two sections like this for me. Is it possible?
The -b parameter to cbfstool add-payload should do this. You can specify any explicit offset you want (assuming the respective CBFS space is still free). However, if you're using an intelligent flasher like flashrom it should only rewrite the sectors that have changes in them anyway, so it should already leave your unchanged coreboot alone (save for the final sector, maybe).
As a secondary improvement, I'd like to have an even more minimal Linux payload in the top 4 MB that has spiflash tools to re-write the bottom 8 MB. Is there an easy way to select which payload will be executed?
Not really. There's a payload called bayou in the source tree that's intended to display a simple menu from which you can pick and choose another payload to chain-load into, but I think it has been in disrepair for a long time. Your other option might be loading something like grub (which I think has CBFS support now? somewhere?) to do that for you. You could also try to boot into your "recovery" Linux and have it display some simple menu with a timeout, after which it could automatically read your SPI image into tmpfs, cbfstool the "real" Linux payload out of there and kexec it.