Thank you, xananax, for your help, even in midst of your own G difficulties.
Your idea about a new scatter file that flashes non-root Android only (by choosing only non-root in the flashtool) sounds very reasonable. I'll try that next time. The only rub is I can't remember the actual size of my partitions and my current scatter file doesn't make it clear, at least not to me.
By the time you posted, I had already gone ahead, using all files from original flash, and 1) reflashed linux.img (a dist-upgrade had screwed up my shut down). Did this as a test and it worked 2) reflashed boot and userdata images, very scary, but it also worked.
As for security, I installed all apps from the Playstore before running Magisk. Then completed root with Magisk. Then did a couple of root things. Then disabled superuser in Magisk setting.
It's not as ideal as a stock Android, but it was the best I could come up with.
A Netflix caveat: my procedure of only being semi-rooted while installing from Playstore made Playstore say that Netflix was "incompatible with my device" even after I installed and rooted with Magisk and chose to hide Magisk from Netflix.
I ended up installing a current Netflix apk listed from another phone. It installed and eventually Playstore recognized my Netflix installation. Research tells me that Playstore reads a cache of your machine and subsequent changes to your machine may outrace that cache. I'm certainly guessing but even today, Playstore continues to see Netflix as a legitimate install.
Thanks again for your reasoned suggestions. As for your own machine, will you try and send it back?
Jake