In CalyxOS you can set the VPN ( ProtonVPN ) to route all your traffic ( including the work profile ) thru the VPN tunnel, giving you extra layer of protection. ( I don’t know if it’s possible on LineageOS )
Yes with the Netguard app (on fdroid) https://netguard.me/
I’ve had older lineage running on a J3 , don’t think it was exactly the same model. At that time it was as simple as building it with brunch, lunch etc. with the right device name , probably something like j3ltekx , you should be able to find that on the internet. It might be more difficult trying to get a newer version to work on that model since it hasn’t been maintained
Om thinking even older , might have been Elite https://bbc.godbolt.org/?disc=elite.ssd&autoboot
Nah planes go wooosh over their heads