Is is possible for a userscript to run on (@match) URLs that begin with chrome-extension://, i.e. change other extensions?
Yes, that's possible. From the Content scripts, "Match Patterns" documentation:
A match pattern is essentially a URL that begins with a permitted scheme (http, https, file, ftp, or chrome-extension), and that can contain '*' characters. The special pattern
<all_urls>matches any URL that starts with a permitted scheme.
(Note that userscripts, in Chrome, are converted to slightly-specialized "content scripts")