Would proxying a lightning hot-wallet with a lightning cold-wallet make the hot-wallet safer?
First of all at this stage all lightning network nodes implementations are hot wallets. There are people / teams working on hardware wallets in lightning. Also I don't get your base assumption why you would trust casa which I believe  is not open source more than trusting btc pay server which I believe is open source. The only reason I see is that you control the hardware of your casa node and it is not some machine somewhere on the web in some datacenter. 

But let us assume your setup and assumptions are valid then in step 6 and 7 of your process you don't need to close the channel. You could just withdraw the funds from your HWN to your casa node. As the entire channel balance is now at casa side there is no risk with HWN being compromised. This is as good as closing a channel moving funds and create a new one but saves onchain tx and fees. 

In step 3 it is important to note that if you casa ode owns those payment channels your casa node can't receive funds or error payments to the HWN. Casa needs inbound capacity. So either you have others open channels to you (e. G. Your customers) or you have to use one of the many submarine swap services that exchange onchain to offchain funds. Such a service could also be used in step 6 and 7.

Overall the node of btc pay server could be private and configured to only accept traffic on port 9375 from your casa node. In this way you make sure only you have a payment channel with it. Since without rendez vous Routing all invoices of your store point to your casa node your cars node might now be at risk. 

That all being said it seems to me that for the concerns that you have you don't need this setup with a proxy node. I am not saying that such a setup might not make sense for other reasons.