Is there any restriction in File system renaming using shove from sandboxed to runtime path??
failed _relinkFile(/Library/InstallerSandboxes/.PKInstallSandboxManager/EFFC026D-F5AD-4F2D-8EB1-E73B78E51E1A.activeSandbox/Root/Library/Application Support/McAfee/MSS/Applications/Trellix Agent Status Monitor.app/Contents/_CodeSignature/CodeResources, /Library/Application Support/McAfee/MSS/Applications/Trellix Agent Status Monitor.app/Contents/_CodeSignature/CodeResources): Operation not permitted
2026-05-27 12:20:37-04 OSX-CG46R0630R installd[8236]: PackageKit: releasing backupd 2026-05-27 12:20:37-04 OSX-CG46R0630R installd[8236]: PackageKit: allow user idle system sleep 2026-05-27 12:20:37-04 OSX-CG46R0630R installd[8236]: PackageKit: Install Failed: Error Domain=PKInstallErrorDomain Code=120 "An unexpected error occurred while moving files to the final destination." UserInfo={NSLocalizedDescription=An unexpected error occurred while moving files to the final destination.,
This is immediately followed by:
PKInstallErrorDomain Code=120
NSPOSIXErrorDomain Code=1 "Operation not permitted"
Based on the installer logs reviewed so far, the failure appears to occur during a PackageKit file relink operation and is accompanied by "Operation not permitted" errors, which suggests a permissions enforcement issue during installation.