Android

Why the official requirement? Just because you don't want the device to be abandoned? Or is there some other "official" value-add I'm unaware of?

I'm going to ignore the "official" requirement because I think your task might actually be impossible with that req.

I use an Xperia XZ1 Compact with LineageOS 20.

4.6" screen. Very similar in dimensions to the iPhone 5/5S, which had 4" screens (just a tiny bit winder, maybe a mm taller). Headphone jack. microSD slot with support up to 512GB. Side fingerprint sensor. Decent (not modern flagship quality, but also not an AI "image" generator) camera. Band 66 support (though no band 71). And a notification LED!

Sony only supported it with two software updates (big surprise) ending with Android 9 (Pie). The Sony website lets you unlock the bootloader with a self-serve portal. You can use the Xperifirm tool to flash stock software & firmware, and custom roms work as usual with flashing, TWRP, etc. The SD card makes custom ROMs an even simpler process.

Note that you need the US firmware for cellular band & network compatibility, but you can copy the two files related to fingerprint sensor usage (system_X-FLASH-ALL-C93B.sin and vendor_X-FLASH-ALL-C93B.sin) from CE1 (chinese) or UK firmware into the US firmware, flash it, and you'll get US firmware with a functional fingerprint sensor.

There's recent builds of Lineage 17,18,19, and 20 (unofficial, unfortunately) with relatively few compromises. Gapps versions and MicroG versions seem to get published once every month or two by the unofficial maintainers. Yes, they're unofficial. But they've been publishing new builds every month since 2019. And allegedly the only reason they haven't gone official is because Lineage puts some restrictions on packages you can include in official releases.

There's also HavocOS and a relatively recent /e/OS build, if you're into that.

Unfortunately my mobile provider (Google Fi) has some compatibility issues with these ROMs, but there seem to be dozens-to-hundreds of happy users out there. The modem has a tendency to crash when signal is completely lost, so if you live in the middle of nowhere like I do, I don't think I would recommend it. But if you live in a city or a country with competent infrastructure you should be fine.

The call microphone has a shitty physical design; it uses sound piped into a single, very long, very tiny hole in the bottom of the phone, next to the USB-C port. Guess what? Over time that tends to fill with dust, and then people can only hear you on calls if you hold the phone at the perfect angle, shout, or switch to speakerphone, which uses a different mic. Fortunately you can clean it pretty easily with a SIM card ejector.

TL;DR this is literally the last reasonably sized phone by a major manufacturer you can use as an actual smartphone with custom ROMs. And there's a good amount of custom ROM support out there.

The other one I would seriously look at is the Pixel 4a, but it's definitely above your size requirement. It might be more useful if you list a height limit or width limit to the phone size instead of a screen size limit -- for instance, I won't use anything taller than 135mm. But the iPhone SE (2016), XZ1 Compact, and iPhone 12/13 Mini all satisfy that requirement, despite having 4", 4.6", and 5.4" screens, respectively. Aspect ratios and bezels are weird!