@federicoottavio thanks again for letting me know. It's very unusual for a build to make it the entire way through our release process yet still have a problem like this! Apologies for the inconvenience. I've added checks for this to the release scripts so this particular issue should not happen again.
In case you're interested, it was caused by two symlinks (for npm and npx) sneaking through into the bundled (but hidden for now) nodejs service. These symlinks pointed at a destination that was outside the app bundle, which is disallowed by Gatekeeper. Incredible how such a trivial issue caused such a significant outcome! Then again... as developers we all know what a misplaced full stop can do 🤣
