<p>Does the CCK api allow me to create a node type, from a custom module, with a bunch of fields that use CCK to store their state?  If so can these fields be locked so that users may not alter them, but still allow the user to add more fields to the node type?</p>

<p>Thanks</p>

I
think
the answer to your first question is "yes" (for Drupal 6, at least, which has elements of the CCK integrated into Drupal Core).  I believe the
Amazon module
does this sort of thing, albeit it with just one field.
I don't think the idea in your second request is achievable, though.  This would seem to require field-level permissions' control whilst Drupal only supports module-level permissions' control.