But they say that browser engines are allowed. So can they JIT?
Yes
How can the OS tell the difference between downloading JavaScript and JITing it vs downloading compiled code and running it?
Whether runtime generated or downloaded from the internet, you cannot run instructions directly on the processor without requesting executable virtual pages in memory from the OS. Executable pages are also a major security vulnerability: https://en.wikipedia.org/wiki/JIT_spraying
An App is not just code, it is an entity within the OS with permission system, metadata etc all attached to it.
A JIT compiler is not above the App’s sandbox permissions.
They look into the app as a human vs looking at the code. iDOS 2 is a great example. Banned for doing that exact thing.