Prioritizing compactness on a Phone while maintaining privacy (& security) within the constraints

changing the slot limit is a one liner change
adding sandboxed play support is a substantial amount of work

also you mentioned above that you can resign lineage for bootloader relocking, but that will not enable verified boot.