What is it with so many people giving parenting advice whenever this topic comes up? OP asked how they could make a GOS device work for a child not which device or approach everyone thinks is the best way!
To your question @GMB
Unfortunately as said before there is no clean and easy way to do this on GOS. Vanadium can't be uninstalled ,as it is a system app. It can be deactivated but your child will probably figure out quickly how reactivate it. Deleting it through something like command line adb or UniversalAndroidDebloater is disadvised by the project as it compromises device security, but if you want to take that risk it is also an option for method 1).
As far as I see it there are two methods that are somewhat tamper proof:
1) Using a secondary user profile for the child, no app installs allowed and restricting the web by using a DNS-service, which is implemented device wide from the owner-profile. Only you have access to the owner profile. Described in detail here
- main downside: if the phone dies or is rebooted the child can't unlock it, as the owner profile needs to be unlocked after a reboot, and only you have the pass
2) https://timelimit.io/en/
Neat and trustworthy app with a friendly developer. You can set a passcode and restrict the usage of apps including newly installed ones. In order to prevent a deinstallation you need give the app device owner permission through adb (see the documentation on the bottom of the website). Unfortunately it does not prevent the child from creating a new user, without restrictions. You could try this, until your child figures out the loophole. As far as I see it, the only option to prevent a new user from being created is by blocking the settings app for your child and only you could access it with the timelimit passcode.
Both options require some playing around with the initial setup but can work well after that. If you prefer a low effort way, maybe a used iphone 12/13 mini (which aren't to expensive) could be an option. iOS built in screentime allows you to prevent new apps from being installed (while still allowing automatic background updates), deactivate safari (but not possibel to reactivate w/o the passcode) and setting timelimits on apps. These settings would be behind a seperate screentime passcode set by you. As far as I am concerned the option that is best integrated into the OS and tamper proof.