Phew.
Okay, looking around, it seems like Gridinsoft incorrectly reports a couple of game engines as trojans. They flag Unreal Engine and the bundling action in Godot. I tried a clean-room build with just a template on a different system and they seem to be flagging that, too. None of the other detectors are picking up anything, so I'm fairly confident everything is okay.