You could do this much easier and better with a Content-Security-Policy. Whitelist the things you want to allow, and set a report-uri to get notified of any CSP violations.

CSP wont help you if you authorize scripts with a source of self or if the malicious script contains a relative "src" attribute.

This approach has the added benefit of letting you know that malicious things are happening.

CSP has report options.

What about those plugins that the user chose and add a script tag? While they should be becoming less common (since I read it's a bad practice), they are still out there.

Did you consider a "silent alarm", that only phones home without displaying an error?

No. Perhaps the most important part of this is keeping the user informed.

What do you think most users would (and should) do if they were told your hosting provider was injecting scripts into the page? Stop using your site?

Hopefully. The alternative (silently alert and hope I pick up the phone) might not be so bad for users if a hosting provider is running analytics or ads, but from a detect-and-alert perspective it's pretty hard to tell the difference between a scummy-hosting-provider script and a credential-scraping bonafide hack. Many people (or robots) who install the latter aren't smart enough to defeat alerting measures, so it's a big benefit if those measures warn the users directly.

Your question is the difference between marketing and craftsmanship. Are you primarily proud of your product or trying to increase your traffic?