Andrew,
So i've never got wbem working properly. I always thought it was a firewall issue, but i have wbem ports open.
When i do discovery on a server with WBEM, windows or ESX it never finds anything. And when you looks at the managamenet protocols it never shows WBEM as an option. Can you think of something that is missing?
You say you need root for teh subscription. to use the root access do you need to enable SSH access and then do a discovery with an account with root access. Once its discovered do you need it to permently use root access to check the updates. or is it just for the subscription and then you can stop ssh to the esx host?