Thanks. I don't know the script language, but can't you build a script with those opcodes that fails to validate if the opcode is interpreted as a NOP, but succeeds if it is redefined to something else? I suppose that the only redefinitons that would allow a soft fork are of the kind "if (condition) then FAIL else NOP", correct?
Yes. You can see this in OP_CLTV:
https://github.com/bitcoin/bips/blob/master/bip-0065.mediawiki#summary and OP_CSV (upcoming):
https://github.com/bitcoin/bips/blob/master/bip-0112.mediawiki#summaryToday there is a third kind, the dedicated "full but non-mining" relay, aka "node", which apparently has a very distinct role and is supposed to be an essential defense against misbehaving miners and other menaces. And, TIL, needs special validity rules.
No, a full node (non-mining relay) does the exact same thing as a miner when it comes to validation but it simply doesn't produce blocks. The "special validity rules" are not consensus rules unlike the validation rules which are consensus rules. Those rules are called standardness rules and both miners and full nodes have them. The standardness rules are local node policy so they tend to change more often than consensus rules because if something is non-standard it can still be valid.
Full nodes are even more important nowadays due to the prevalence of SPV mining. Many miners now aren't running full nodes, meaning they are not fully validating every single block and transaction they receive. The only nodes that do this now are the full nodes and they are what are enforcing the consensus rules because most miners aren't doing it and SPV wallets cannot. These full nodes protect against either major mining screw ups like the July 4th fork and against malicious miners.