How do I run an arbitrary subprocess from an Xcode extension?

I'd like to start a subprocess from an Xcode extension. My prototype performCommandWithInvocation method looks like this:

- (void)performCommandWithInvocation:(XCSourceEditorCommandInvocation *)invocation completionHandler:(void (^)(NSError * _Nullable nilOrError))completionHandler
{
    NSTask*task= [[NSTask alloc]init];
    [task setExecutableURL:[NSURL fileURLWithPath:@"/bin/sh"]];
    //option A: [task setArguments:@[@"-c",@"echo hello from sh"]];
    //option B: [task setArguments:@[@"-c",@"/usr/bin/python3 -c 'print(\"hello from python3\")'"]];
    [task launch];
    [task waitUntilExit];
    int status=[task terminationStatus];
    printf("status: %d\n",status);
    completionHandler(nil);
}

So there's two options there: option A, or option B. (Uncomment to taste.)

Option A does work. /bin/sh starts, and runs echo, and it prints hello to its stdout. I was foolish enough to let this convince me that this whole thing might be a goer.

Option B does not work. I get an error: xcrun error: cannot be used with in an App Sandbox. Which is annoying, as virtually all of the scripts I want to run are written in Python, and I'd quite like this to be an option. How do I fix this?

I tried removing the App Sandbox settings from my extension, but then Xcode refused to load it.

I added Read/Write permissions to all the File Access settings in the App Sandbox section, even though most of them sounded irrelevant, but no improvement.

Then I ticked every tick box I could find. My extension can debug, it can JIT, library validation is off, it can use the camera and access my photos and read the audio and my contacts and open sockets in any direction it wants and goodness knows what else.

But it seems it still can't run python. How do I make this work?

--Tom