Sorry, red herring - it was a problem with my development machine. On another (also Intel) Mac it works as intended. Apologies for the noise.

Also, please let me know if you need more info. The app is sandboxed and has all the relevant entitlements, and if I bypass the above code and just try to open the capture device, the 'xxx wants to access your microphone' message is not displayed. There is a way to get it to work though. If I run the app from Terminal (by directly running the binary in Contents/MacOS, rather than using open), then everything works as it should, with the exception that the popup reads 'Terminal wants to access your Microphone', rather than the name of my app. Terminal has some funky entitlements, and this is what leads me to believe this is a 'Privacy' issue.