If you had to run this stuff on another platform, you'd just spin up a VM or container, right?

To get around the legal issue that they won't do this for an open source project, just create a shell corporation.

That shell corp then writes a closed-source plugin wrapper in another project entirely.

Put widevine in that wrapper. Then your open source project just has to include that plugin.