disable SIP on a remote/headless machine running Sierra?

Solution 1:

Disable SIP without using recovery mode at all? I have found other threads (such as here and here) about this and the consensus appears to be "no", but I thought I would reiterate the question here to be thorough.

System Integrity Protection cannot be disabled from a normal mode boot (from ones's Desktop). The Apple provided method is to use csrutil disable from Terminal while booted to macOS Recovery. What good would it be if it could be disabled from a normal mode boot? (Rhetorical question!)

As mentioned by David Anderson in a comment, one could use rEFInd to disable SIP, however, this cannot be done from a normal mode boot (from ones's Desktop) and would require having rEFInd installed and rebooting the system to rEFInd, which you'd have no control of from a headless-system without a keyboard.

Empty the trash of protected items without having to disable SIP first?

From a normal mode boot (from one's Desktop), no, however one can delete the various .Trashes and .Trash directories from Terminal in macOS Recovery without disabling SIP and then reboot back to normal mode boot and those directories will be recreated.

What good would SIP be if one could bypass its restrictions from a normal mode boot? (Rhetorical question!)

Obviously, you'll need to temporarily add a keyboard and monitor to the Mac mini to boot to macOS Recovery in order to resolve the issue.