I get that the propietary harness is better most of the time, but if this is really a risk factor to consider why not go with one of the open source harnesses?

Pi/OpenCode seem pretty straight foward and widely used enough for this to be viable

OMP as I understand does it's own vendoring of tools, so I assume it'd be a pain in the ass to audit, but that means you're even safe from base OS shenanigans