Practically, just run the macos-inside-kvm-inside-docker command. Not very fast, but you can compile the entire thing outside of the VM, all you need is the final incantations to get Apple's signatures on there.
Legally, you probably need a Mac. Or rent access to one, that's probably cheaper.
Legally, you probably need a Mac. Or rent access to one, that's probably cheaper.