Just mount the release ISO and edit the files in place?
mount -t cd9660 /dev/`mdconfig -af pfSense.iso` /mnt
Nearly

# # mount -t cd9660 /dev/md`mdconfig -a -t vnode -f /usr/obj.pfSense/pfSense.iso -n` /mnt
# ls /mnt
.cshrc conf.default root
.profile dev sbin
.project dist scripts
COPYRIGHT etc tmp
RELENG_1 lib trigger_initial_wizard
bin libexec usr
boot mnt uzip
boot.catalog pkg_info.txt var
cf proc
conf rescue
# df
Filesystem 1K-blocks Used Avail Capacity Mounted on
/dev/ad0s1a 3807702 1588878 1914208 45% /
devfs 1 1 0 100% /dev
devfs 1 1 0 100% /var/dhcpd/dev
/dev/md0 33870 33870 0 100% /mnt
To unmount, you to know the device 'number' (name).
While a
unmount /dev/`mdconfig -l` will do for the umount part, you have to
mdconfig -l to know the actual name of the device,
md0 in my case.
Then a
mdconfig -d -u 0 will roll everything back to normal.
Nice to mount a ISO like this.... but the real pb is : can we write to the ISO ? - I'm still on that one (the sited option
-o no readonly doesn't work

). I'll be back.
[edit] Back !
Bad news: doing it all by hand :
# mdconfig -a -t vnode -f /usr/obj.pfSense/pfSense.iso -o noreadonly
md0
# mount_cd9660 -o rw -s 0 /dev/md0 /mnt
# echo hello > /mnt/etc/test
/mnt/etc/test: Read-only file system.
The
-o rw option (not documented for mount_cd9600, but is exists) isn't taken.
The final error message is my last word .....

Long live
custom_overlay