sorry, i should've followed up 😅
yes, i did eventually figure it out - the group id for the mac builds needs to have your team id as a prefix (this is new for sequoia)
https://developer.apple.com/documentation/xcode/configuring-app-groups#Create-App-Groups-for-macOS-apps
my app was using the Multiplatform project template, and the new group id requirement is not valid for other OS targets... i ended up separating up my app and widget extension targets: macOS and everything else.
Topic:
App & System Services
SubTopic:
General
Tags: