This idea was inspired by this post topjohnwu/Magisk#509 (comment)
I got this working with CalyxOS 2.11.0 (Android 11) with full AVB Verity enabled and was able to lock the bootloader after flashing and still have su.
First, make sure you can build and sign a proper CalyxOS for your device. This is probably the hardest part.