I've since learned about launchctl asuser, which allows me to launch a process over SSH with an Aqua session, and with stdin/out/err attached:
torarne@macos-15-5-0 % ./foo
Session ID: 100044
sessionIsRoot: false
sessionHasGraphicAccess: false
sessionHasTTY: true
sessionIsRemote: true
^C
torarne@macos-15-5-0 % sudo launchctl asuser 501 ./foo
Session ID: 100003
sessionIsRoot: false
sessionHasGraphicAccess: true
sessionHasTTY: true
sessionIsRemote: false
^C
Topic:
App & System Services
SubTopic:
Core OS
Tags: