With an unspeakable amount of problems, which I will spare you, I finally have managed to install Raspberry Pi OS and VeraCrypt.
I have used VeraCrypt (and, previously, TrueCrypt) for many years, but always on Windows and with the GUI.
I have spent significant time in the manual trying to find this out prior to asking the question. I just can't find any mention of it: https://www.veracrypt.fr/en/Command%20Line%20Usage.html
How do I actually tell VeraCrypt on the command line to encrypt the system (and only) disk? I'm not talking about mounting an existing container or creating a "file". I mean the same thing as is done in the VeraCrypt GUI by clicking:
System > Encrypt System Partition/Drive
I feel a cold sensation of confusion and worry, as if this... might not... exist. But that cannot be. It mustn't be. It would make no sense. It has to exist. The command-line version is just that: a different interface to the same underlying software. And encrypting the system disk is by far the most important feature of this software, and the most common use case. I refuse to believe that it isn't possible.