It looks like McDonalds uses a German brand of coffee maker, on their instructional pages it shows the cleaning procedure is prepare a cleaning jug and then place both hoses into said container, run cleaning program. It appears the jug is already intentionally over-sized to prevent it from being shut into the milk refrigerator, (a decent first step - a reminder.) It also appears there are no electronics in the refrigerator to electronically verify what liquid is being used. So the simplest next step is a lockout, for example make a brightly colored storage lid for the jug, which must be placed in the dispensing area (perhaps verified in placement with a magnetic proximity switches.), however this only solves the "normal mistake" mode. To "fool-proof" the system would take active verification of liquid, perhaps with a tagging system on the milk, or a sensor in the fluid stream.