No local network access when using launchd

[XYZeb]

Am following instructions as per your blog to keep a smb mount alive, but I think I might be hitting an issue with macOS Sequoia 15.1 and hoping you can help.

When I try to user runner using launchd (via launchctl), the uptimekuma push fails. (UptimeKuma is running in a container on my NAS - internal ip 192.168.0.103)

In the log file from runner, I get the following (TOKEN removed):

--- Runner Delivery Errors ---

failed to call success notification URL: failed to GET 'http://192.168.0.103:3001/api/push/TOKEN?status=up': Get "http://192.168.0.103:3001/api/push/TOKEN?status=up": dial tcp 192.168.0.103:3001: connect: no route to host

From within iTerm, everything works great, including ping:

 % ping 192.168.0.103
PING 192.168.0.103 (192.168.0.103): 56 data bytes
64 bytes from 192.168.0.103: icmp_seq=0 ttl=64 time=0.464 ms
64 bytes from 192.168.0.103: icmp_seq=1 ttl=64 time=0.760 ms
64 bytes from 192.168.0.103: icmp_seq=2 ttl=64 time=0.734 ms
^C
--- 192.168.0.103 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.464/0.653/0.760/0.134 ms

Investigation of the issue seems to indicate macOS 15 has changed the way that local network access is permitted.
Apple published this technote a couple of days ago.

Inside Settings > Privacy & Security > Local Network there is a list of what is allowed local network access. iTerm is in this list, but neither launchd nor runner are, and there's no way to manually add additional items, and I'm not prompted at any point to allow anything.

I've tried renaming the launchagent in case that is the issue:
/Users/ccaajcl/Library/LaunchAgents/com.auniquestringihopeasd123.mount.plist

I'm loading with launchctl load com.auniquestringihopeasd123.mount.plist but have also tried the bootstrap, enable, kickstart route as well.

I'm at a loss about how to proceed, so any insight appreciated. Thank you for your time.

EDIT: I've also tried as a LaunchDaemon - this fixes the network access so the push succeeds, but means the share gets mounted for root and not for my user, which rather defies the point!