launchd daemons need their own TCC grants
Mac background services need their own privacy permissions; testing from a terminal lies.
how it works
TCC grants are per binary path+cdhash; launchd makes the daemon its own responsible process; Mic/Camera rows only appear after requestAccess, so ship a tiny launcher that requests then spawns the real binary.
Technique: A pattern or hard-won lesson, written down so it isn't learned twice.
The code for this one lives in a private repo. This page explains the idea so you can build your own.