Adding the result of a focused probe, run on macOS 27.0.1 (26A434) as root, with a Developer ID team (LM3P28DNVQ) that does not yet hold the com.apple.developer.vfs.snapshot entitlement:
macOS version: Version 27.0.1 (Build 26A434)
effective uid: 0 (running as root: yes)
open("/", O_RDONLY) returned fd 3
calling fs_snapshot_create(fd, "pixelprotect-probe-1793832029", 0)
fs_snapshot_create returned -1, errno 1 (Operation not permitted)
result: snapshot NOT created
The same call fails identically without root, so the restriction is the entitlement, not privilege. The probe is a small Swift package (one executable target that calls fs_snapshot_create and cleans up after itself) that I can attach to a code-level support request if that is the right next step. Thank you.