I went over everything again and noticed that my developer Team ID was prepended to the app's bundle id for the denial entry in swcutil_show.txt.
The documentation (https://developer.apple.com/documentation/xcode/supporting-associated-domains) says the appIDs entry should be in the form of .. I'd assumed Application Identifier Prefix was the Apple ID of the app as I've seen these used interchangeably before. Anyway, I added the Team ID as a prefix and all is working.
Not sure if this is an error in the documentation or if app's Apple ID is used in production. As a hedge I added both variants (prefixed by Team ID and prefixed by App ID) to the appIDs entry.
Topic:
App & System Services
SubTopic:
General
Tags: