As they say, it depends.
Many people would do Y. That is, install the new server as the old server and cut over. This will require some downtime, though, since you are likely to run into problems, if you have two machines on the network with the same name. So you would have to shut down the old server before you copy. Or, well, you could rename the server once you are satisfied. This requires one extra step in SQL Server:
EXEC sp_dropserver OLDNAME EXEC sp_addserver NEWNAME, 'local' -- Restart SQL Server after this.
However, there is one thing in your post, which makes me think that you should go for Z. Your post suggests that applications are connecting with sa. That is very bad, and that is something you would need to fix if this is the case. The server upgrade could serve as a kick in the rear parts to do that action. And I should hasten to add that connection should not be by any other sysadmin account. Applications should connect only with permissions to run stored procedures and possibly read/write data in tables.