But ```CONFIG_VERSION``` would only change once per release, just as the Picard version number already does. And if we need a hook to run, the Picard version increase will force it to execute in the same way ```CONFIG_VERSION``` does. So I'm not sure I see the difference.

Code-wise, there's nothing wrong with this. The only reason I think using release versions is better is because it would be nice to move the VA-config-upgrade code to this system, which would be impossible otherwise because it predates ```CONFIG_VERSION```.