1/ Secondary fusing - single fuse or both transformer legs?
Agree with Franco: fuse both legs if you're gonna do it, and don't put a fuse in the center-tap of the power transformer. Use a single HT fuse like Marshall between the OT center-tap and the first filter cap.
2/ Silicon diodes in series with the GZ34
This doesn't protect anything, but does keep the amp playing in the event of a shorted tube rectifier. So think of it as a way to keep the amp performing even after a failure.
3/ OT primary flyback diodes
I've never used them, but that doesn't mean they're not a good idea. 3x 1N4007's (or similar) in series is typical to give the flyback diodes a 3kV total rating. They mostly help if you play the amp with no speaker load attached, or speakers blow.
4/ Resistor on the bias pot(s) to protect against wiper opening
Always a good idea.
... are there other tips worth including?
I asked a question like this on this forum 10 years ago (or more). Basically, I wanted to know every typical failure mode for an amp so I could incorporate some way to prevent it as well as some external test point to identify it once it happened. As I recall, we never settled on "typical failures" and the only external test points I wound up with were bias points.
Why? Cause in the absence of abuse and catastrophic failure of parts, an amp may live fine for many decades. And the nature of "abuse" can be hard to predict when it is defined as "wrong-use".
Hopefully some others will have some good idea to incorporate.