Sorry about the delay responding here. I thought I would post in detail in case it helps someone else.
The first mistake I made is in assuming that converting a packet tunnel to system extension is just a matter of updating the entitlements to say that I am using system extension, but I figured out that its incorrect - I needed to delete my old network extension target and create a NEW target in xcode selecting the type as system-extension. So I guess that makes xcode to package the application differently - the system extension app has the Library/SystemExtension folder with my system extension code inside it etc.. which will happen only if we create a target specifically marked as system-extension in xcode.
Then in developer.apple.com for the app IDs, the UI APP ID has BOTH network and system extension checked, the packet-tunnel app ID has Network extension checked but NOT system extension.
Then of course I had to mention it in my entitlements. I am listing it here for anyone's future reference
Packet tunnel entitlement:
UI App entitlement:
And then I built the image, and uploaded to apple for "Developer ID" signing and it was signed all well and fine and then I exported the signed app as a mac app. Now this is where it was frustrating as hell - the app would work fine on my laptop, I can open it and it will ask permission to install system extension etc.., but it would NOT work on anyone else's laptop - it would not ask for permission to install system extension, radio silence. And in the system logs there is really nothing legible that says what the problem is. I spent at least a couple of days complete waste of time chasing this - and finally figured that the developer ID signed app has to be moved to the Applications folder and only then the system extension would work. And how did I find that out ? There was this slide deck - https://objectivebythesea.com/v3/talks/OBTS_v3_sKnight.pdf - where somewhere deep inside it there was an allusion to the need to move the app to Applications folder, and thanks to this kind soul who made the pdf, my pain ended in two days. These are the things which apple has been terrible in documenting. Does no one at apple run through the sequence end to end and see what are the steps required and document it ???
At any rate, after the above, it all works fine - it asks for permission to install system extension and I allow it and it creates a seperate process with my system extension code - that is a thing to note when writing system extensions, unlike the previous packet tunnel mechanism, the system extension code runs as a seperate process that keeps running for ever as long as the system extension is installed, ie it keeps running even after your app is terminated. And when you relaunch the app and again activate system extension, the process will still be the same, its not restarted - ie make sure to cleanup and have the process start from a clean state without actually restarting the process
