Check out Beeper (beeperhq.com). They have an all-in-one service that'll get you Whatsapp without hilariously dubious security promises from Facebook.

Basically what they do is build and maintain a bunch of Matrix bridges for you. Whatsapp, Imessage, Telegram, Facebook, Slack, Twitter, Skype...

It appears the Beeper service by default runs on the beeper servers, with a subscription fee, yet I see there is a solution one can run locally https://github.com/spantaleev/matrix-docker-ansible-deploy

Does anyone have experience running the open version on their machine? (self-hosted)

I do similar. Just use my previous Android (eg Pixel2) with the apps on it and my current phone (Pixel3) is trimmed (disable what you can, no apps but Firefox). I leave the 2 in a known safe location.

Not a 100% solution but is dead simple and better than 0%

In your scenario what do you even use the 3 for? Just web browsing?

Web, Phone, SMS. Email is via web-interface.

And I've actually got three apps: Firefox, Mattermost and Wireguard

Carrying a cheap/old/second-hand small android phone can be cost effective. Plus, it works as a backup for phone if the PinePhone runs out of battery.

Also, PinePhone can run anbox - slowly.

Any first hand experience with Anbox on Pinephone?

That is the solution I am considering at the moment as well. Its not the prettiest, but it will likely work as a stopgap measure.

You can also use one device to hotspot another thus providing data without the added risks that come with having another mystery binary blob.

You'll need a external battery pack though for longer days away from home.