How do I disable private browsing in a way that my kids can't just turn back on?

This is complicated. Just disabling that option doesn't mean there's not other ways to flip the prefs to "never remember history" basically resulting in the same, or, when in normal browsing to be able to redact history and site data, either by domain, or by time spans — or by just pressing the "Delete" key when in the browsing history library pane reachable from the main menu. And even if you hide all the buttons and disable their key shortcuts (that, well, can be enabled back for the session by anyone, and then removed to leave no trace, if anyone's so inclined), there's still the possibility of sanitizing the browsing data using e.g. an addon… so I'm not sure the ask to just disable private mode is the solution for you — you might need to look more into enterprise policies to see what all can be disabled/removed from the installation, but I'm afraid you'd be playing whackamole — and if the kids see that as a challenge to try to circumvent the restrictions… well, I'm afraid you'd be the one playing catch up;)

Not sure I have good advice for this, the above is merely a reminder that removing specific parts of the functionality does not eliminate the whole of the privacy options available in the browsers.

Choice a 'family-safe DNS' and for more control 'family-safe firewall' , you may need to setup your own Ingress/Egress filters. In Firefox; Menu>Settings>DNS over HTTPS>Max Protection>Choose Provider>Custom>{add your chosen family-safe DNS DoH service url string here}