This idea was inspired by this post topjohnwu/Magisk#509 (comment)
I got this working with CalyxOS 3.3.1 (Android 12) with full AVB Verity enabled and was able to lock the bootloader after flashing and still have su. The OTA update zip generated was also tested against the Calyx 2.11.0 version (with Magisk) and it works well.
First, make sure you can build and sign a proper CalyxOS for your device. This is probably the hardest part.