Hmm, I was able to get the .app to run, but it seems like there's something else wrong with that version because none of the buttons in the game do anything. They animate when I click them but nothing happens. The other version that I removed the xattributes from myself works perfectly.
Damn. I hoped re-exporting the original that worked and adding the missing _CodeSignature folder from the Mac export would be a workaround, but if it needs a new signature each time then that's not an option. And I don't have access to the borrowed Mac so it could be a while before I can find a proper fix.
I think I finally figured out what happened here. I've been using Godot v3.4, but when I tried the Mac export I downloaded the latest version (v3.5, which was released a couple weeks ago). There was a slight change to how it handles inputs that caused a problem with the UI buttons. One extra line of code, and it's fixed.
As it turns out, v3.5 also fixed the issue that was preventing me from code-signing, so I should be able to push updates and troubleshoot issues for the Mac version from my own device now.