Not sure on the scripting front, but could you not assign a role to be exempt from the locking in the workflow and run the script as that role?