It totally did work! I updated the apps and the docs (and the blog post) to reflect this. It is pretty self-involved and requires an active Apple Developer subscription – but it does get everything running without disabling SIP.

Thanks again for the tip ;).

Oh neat, cheers. Credit to GPT 5.6 Sol for actually unearthing this on my behalf, too. :)