My solution would probably depend in some measure on the sensitivity of the material to go into /mydynamic and the relationship between the pages in mystatic and those in /mydynamic (e.g., is there a subordination relationship between multiple static pages and one or more dynamic pages).

If the sensitivity is low and the relationships dependant only links from only a very few static pages, it may even be practical to rely on (gaghhh! I know no-one here ever expected this from me.) the truly lousy option of "security by obscurity."

The "few" consideration comes in here: Create a mystatic^test.htm based on each parent mystatic.htm, adding a link to the relevant child-generating CGI::App script, and deploy it and the CGI::App script (obviously, after careful testing on your laptop) to the public-facing server.

Potential problems: all those you've listed, all those associated with any attempt at security by obscurity; and the need for cleanup later.

But if the risks of penetration (associated with having artistes of evil or the random set of folks who make just the right typo access your new material) are truly low, this might present a lower cost solution than putting a pure dev-server on line.