My first instinct is to recommend a recent Pixel with GrapheneOS:

• Make sure to buy a factory-unlocked model so that it’s not locked down to the stock OS. Preferably also gently-used second-hand so no money goes directly to Google.
• Of the options, GrapheneOS gives you the most compatibility, security, and updates.
• Installing GrapheneOS can be intimidating at first, but it’s pretty hard to mess up if you install through a Chromium-based browser.

I’ve also used CalyxOS and it’s a solid option that supports a few models outside of Pixels. But if you end up needing Google Play Services, you’ll be stuck with its replacement microG, while GrapheneOS offers sandboxed full-fat Google Play Services. While still secure, it’s not the hardline security of GrapheneOS.

I have no experience with FairPhone or Linux phones. Fairphones’ main attractions are the easily replaceable battery and microSD slot. Linux phones are still too cumbersome for the regular user to daily drive.

EDIT: see also this table comparing privacy-focused options https://threecats.com.au/comparison-of-custom-alternative-android-os-roms-grapheneos-divestos-calyxos-iodos-eos-lineageos-stock-android-aosp

In the US, AT&T, Verizon, and T-Mobile have an oligopoly over the cellular infrastructure. All of the other carriers (MVNO) just piggyback off the infrastructure of the big three. Traditional voice calls and SMS (“green bubble”) texts are unencrypted and logged, no matter the carrier. Carriers can also perform cell tower triangulation and track the IMEI, which is permanently associated with your phone, surviving even an OS reinstall.

One way you may try to avoid handing over identification at activation or payment for cell service is to buy a 1-year prepaid SIM with a prepaid gift card to a trusted friend’s or otherwise shared mailbox. Or buy a prepaid SIM at a brick-and-mortar store with cash and top off with refill cards thereafter.