Update: there's a simple unencrypted plist that controls this. Apparently "fixing" it is as simple as writing the app path along with a date far in the future using `defaults write`... eg

    defaults write ~/Library/Group\ Containers/group.com.apple.replayd/ScreenCaptureApprovals.plist "/Applications/CleanShot X.app/Contents/MacOS/CleanShot X" -date "3024-09-23 12:00:00 +0000"