It totally did work! I updated the apps and the docs (and the blog post) to reflect this. It is pretty self-involved and requires an active Apple Developer subscription – but it does get everything running without disabling SIP.

Thanks again for the tip ;).