Just to be clear, you can’t use SMJobBless from a sandboxed app.
Yes, this is using a non-sandboxed XPC service (essentially the EBAS code), so it shouldn't be running into that sort of problem.
SMJobBless has largely been replaced by SMAppService, which can install a daemon.
I was hoping to still support macOS 12, while SMAppService is macOS 13 and later. But if I have to switch, I can.
[1] The caveat here is that, starting with macOS 14.2, the daemon itself must be sandboxed.
That probably nukes my use-case, unfortunately. The daemon has to be able to move files and folders (well, bundles) into and out of specific folders within /Library, which is presumably not allowed in a sandboxed daemon.
I was given an entitlement to allow secure file system access, but you can't move folders with that, and so I was thrown back to SMJobBless, but even that avenue looks like it's closing.