Uh, no, construction of a custom plan node is entirely driven by the PlanCustomPath method as far as I can see. You're free to ignore what create_scan_plan did and insert your own tlist.
Are you sure? Even if it's true, this targetlist should still contain each and every Var that's been requested. If I'm correct, the only way to ensure that is to call build_path_tlist(), which is static (oops!). Perhaps I could make my own, but it uses replace_nestloop_params() (again, static), and the problem goes further and further.
As I understand, making build_path_tlist a non-static function would solve the problem.