If you want this, (I don't advise it but you seem to have your heart set) the way to do it goes like this:
1. Generate a fresh root as you do today. Keep the resulting CA certificate for the root to one side, let's call this CA1
2. Create an intermediate CA certificate, this says there's a new CA, let's call it CA2 with a new private key, and this certificate gets to have constraints. Put all the constraints you've decided upon in here. Sign it using CA1 with your private key.
3. Destroy the private key for CA1.
4. Tell Firefox to trust root CA1.
5. You can now issue from CA2 and since it chains back to CA1 this is trustworthy, but only so long as it obeys the constraints. You can't issue from CA1 (which is fully trusted) because you destroyed the key.
1. Generate a fresh root as you do today. Keep the resulting CA certificate for the root to one side, let's call this CA1
2. Create an intermediate CA certificate, this says there's a new CA, let's call it CA2 with a new private key, and this certificate gets to have constraints. Put all the constraints you've decided upon in here. Sign it using CA1 with your private key.
3. Destroy the private key for CA1.
4. Tell Firefox to trust root CA1.
5. You can now issue from CA2 and since it chains back to CA1 this is trustworthy, but only so long as it obeys the constraints. You can't issue from CA1 (which is fully trusted) because you destroyed the key.