Are Waymont contracts upgradable?

SafeProxy upgrades are performed through the same function used for normal transaction execution (Safe.execTransaction if not using external signers and ExternalSigner.execTransaction if you are using external signers). These functions (when called for normal TXs, upgrades, or whatever) always require both a signature from one of the user's signing devices + a signature from the policy guardian (assuming the policy guardian has not been disabled, in which case only the user's signing device is required).