Hey Matthieu,
Please forgive me if this is irrelevant, but I'm curious about your working model. You say you don't want to generate JS on the client side because that code can easily be changed. Are you concerned about security and don't want the user to be able to change the JavaScript output from Blockly? Could the XML you are sending not just as easily be changed? If this is the case then there is no security benefit to sending XML as opposed to JS.
From my (limited) knowledge of Blockly I think that it should be possible to generate code from XML outside of a browser. It's an idea I've been toying with myself, but have yet to start on.
As a thought, did you try to create a dummy "window" object in your nashorn environment that is just there to stop errors being thrown. That way, there should be minimal changes needed to the Blockly core files, meaning that, as Blockly is certainly very actively developed, there should be less patching involved for new code releases.
Blockly looks to me to be extemely well written, so I'm sure that Neil and the Blockly team ahve written it in such a way that "window" is not needed for code generation.
I am unfamiliar with nashorn, but think node should be a better option as there are alot more users out there to help you.
Sorry I don't have all the answers, but will help wherever I can.
Phil