OMG, user error, but one that Apple could prevent. I revisited the docs for keyboard extensions and found it right in the first paragraph:
Custom keyboards operate in a sandboxed environment running in an isolated process. This sandbox’s default configuration disallows access to the network and prevents writing to the containing app’s shared group containers (reading is permitted). Open access lets you do things like store keyboard configuration, perform more complex analysis on text the user typed, or provide advanced features that require server support.
But Apple could help developers by mentioning RequestsOpenAccess in the error message instead of being somewhat cryptic about it.