I want to be able to use scripting to generate a GUID for new content, but do so in a hidden field so that users cannot ever change the value.
According to @Sebastian, an extension to scripting is required:
You can mark a field as disabled and create the ID with scripting. But I have to make an extension to the scripting extension for that. Feel free to create a feature request.