Mostly I'm playing around here -- I wanted to log if that sort of discrepancy came up. And then I wanted to find the path to the possibly-offending process, and flag it for examination. And I knew I could go from bundle ID to path, and vice versa, and that was the reason I was asking.

I was referring to "Signing a Daemon with a Restricted Entitlement." The bundle is signed. I'll go over your article again; I've confirmed it's the entitlements it doesn't like. (It turns out I don't currently need the entitlements yet -- but the plan is to use Endpoint Security in it eventually, I just don't have that permission yet.)