I've also added a feature request to support this (FB9052948). It would be amazing to see it happening on next WWDC!

OK got the solution and I'll share it here (even if it's a little... embarrassing). Short version: Scripts that are added to the app's package are treated as 'apps' from Xcode/Organiser POV, so they are required entitlements. I had a script (by mistake) and it was causing the error. In fairness, the error message did point to the script, I just assumed it was auto-generated by Xcode. Longer version: Because Firebase has no proper support yet for Mac Catalyst, I added it manually into the project. The Firebase package includes a script called "upload_symbols" used to automatically upload symbols for Crashlytics. I didn't know, but Xcode automatically added it to the target, so it was being bundled inside the package. When later I was uploading the app to AppStoreConnect, it was trying to get the sandbox entitlement from this script as well, which of course didn't exist. Hope this helps someone in the future not to loose a good few hours in such an embarassing issue!

In my case I had canPerformAction:withSender overwritten in one UIViewController but not all the methods were calling the same controller (since the toolbar is on top of a UISplitViewController). This caused many issues, but once I removed the method they disappeared.