Regarding, Procedure for Minimizing Risks with a Software Updater that Runs as 'root', Mark A writes with an excellent excellent suggestion of using virtualization via VirtualBox for the temporary bootable system:
I know this is obvious to you, being a software engineer like I am, but your readers may benefit from the understanding that a virtual hard drive can have its changes "rolled back" for free after such a potentially dangerous upgrade and restored to a condition ready for the next one.
Mac OS X is on the official virtualbox list of supported guest OSes. It's just a "normal" EFI-booted Intel OS. I believe Apple changed their license policy for hosting in a VM back in the Lion days.
There's the longer, hackier way ala https://www.robertsetiadi.net/install-os-x-virtualbox/
Or the way you suggest creating a pristine install and where I'd add a last step to clone the raw drive into a dmg image and then to a virtualbox image via https://www.virtualbox.org/manual/ch08.html#idp59618720 so something like
$ VBoxManage convertfromraw NewImage.dmg NewImage.vdi --format VDI
And a young geek's view (the kind my son would probably prefer rather than actually reading instructions) https://www.youtube.com/watch?v=Nod7cpxzxLc