public-inbox seems to be the best of both worlds indeed. Interestingly it fits your option 1: posting is open and the admin is in charge of handling spam.
But public-inbox goes way further with other means of pulling, and the easy and trusted replication gives it the same status as the code: the repo is the source of truth, not the email endpoint. I could see projects using that and, say, gitolite as the two main bricks for running a project. Now all we need is a simple CI/CD system that is designed to run on its own rather than in a specific ecosystem
But public-inbox goes way further with other means of pulling, and the easy and trusted replication gives it the same status as the code: the repo is the source of truth, not the email endpoint. I could see projects using that and, say, gitolite as the two main bricks for running a project. Now all we need is a simple CI/CD system that is designed to run on its own rather than in a specific ecosystem