As of current versions, would any of these setups pass safetynet checks? Would these pass?  

OP3T + LineageOS + Kernel that doesn't show bootloader unlocked status?
and also
OP3T + LineageOS + Kernel that doesn't show bootloader unlocked status + Magisk?

I'm currently on Marshmallow and am considering upgrading to 7 (through lineage) but I want to make sure I can pass checks because some apps are a royal pain to use/install if I can't pass the check.

(I would likely not be using Xposed at this time, so I'll leave that out of the equation).
I have been using my OnePlus 3T with LineageOS 14.1 without su and with a custom-built kernel for half a year now. SafetyNet passes, AndroidPay works.