@DTS Engineer that's a great idea, thanks for taking the time to post 👍 Sure enough, the 'mock' Info.plist contained keys that weren't present in the original. After adding CFBundleSupportedPlatforms with an array containing the single string MacOSX, System Information now reports the app as Apple Silicon instead of iOS. Issue resolved!

I really am my own worst enemy. The internal code signing error was caused by my leaving the directory containing the binary read-only for my user and group. Once I gave myself permission to write to the directory, the self-sign worked and the firewall choice became persistent. Doh.