Tell TWRP to decrypt for ota

There doesn't currently seem to be a way to tell TWRP to decrypt /data before an OTA. As you've said, this prevents the Magisk addon.d script to work, since the main part of that script itself resides in the /data partition. (But it also seems to require other things from the /data partition, so we can't just move it).

Here's a workaround:

Since you're on LineageOS, you can install your OTA update manually in TWRP, after decrypting. First download (not install) the OTA in the LineageOS updater. Then reboot to recovery manually and select the OTA zip from /data/lineageos_updates.

It's a bit more cumbersome than automatic-recovery-OTA, but at least it doesn't require adb or manually downloading the zip to your internal storage, where it is writable by any app with Storage permission...