The problem here again is that I cannot restrict the intern to his folders only; he can see all the Asset folders and can replace any file -- either through malice or incompetence.
Unless I'm missing something you want to be able to jail a user to only his folders?
I just tried this. While jailing a user to his own folder site wide isn't (currently) possible, what you're doing should be working; you have to do that on a field-by-field basis. Make sure you're jailing the the right field?
When your intern goes to edit an entry, he shouldn't be able to replace an asset file in another folder if he doesn't have upload permission in the asset's source folder.
Make sure only his asset source is checked. For example: I created 2 asset sources:
Intern Images and
Images. As you mentioned, the only folders the intern can view and upload is
Intern Images; everything else is unchecked.
To test, I made a sample entry with my admin user and selected a PDF in a source that the intern user doesn't have access to. When I go to edit that entry as my Intern user, I can see the other assets in that folder—unless I've jailed it to a single folder—but I can't replace the actual asset because I don't have upload permission on that asset source. I can of course swap the asset for something else but the original asset FILE (the PDF's content) is left untouched.
If you're asking about replacing files that the Intern has access to as well, that's a whole other bag of worms and IMO trust issues. Security is a 2-way street.
However, I wonder if you could write a plugin to intercept the upload request and rename it before Craft has a chance to fire the "would you like to replace the file" so you always have a unique file name? IMO that gets touchy because you start to have 2 or 3 different versions floating around and that ends up causing even more stress.
Practically speaking, WordPress actually does this by default (appending -1, -2 to a file) and in my experience, it can drive users crazy. If you upload a file and you realize you have a typo or some part of your image still needs work after approval—and that file path is already linked from a couple spots on the server—you end up deleting the file and then reuploading again. Craft's method of asset management is so much better in this respect. But with great power comes great responsibility, as they say.