SOLVED - 

1) We wrapped the .vm in XML like so:

The actual velocity code is wrapped in a CDATA tag, so it is not parsed as XML.

2) Our custom studio document class looks like this:

We originally thought we'd need custom import/export logic to strip the CData, but turns out the default behavior of %Studio.AbstractDocument is to CData escape the stream, so this is automatically taken care of: