Not to disrespect omarchy intent, but if you want provably safe OS, is there not a more reduced surface yet, such as .. dare I say it nix?

If that kind of reductionism is too far, how about Alpine?