Also my friend showed me how to remove the xattributes from the .app package and that allows the mac version to run. They say that problem is something about quarantine tags or package signing or something. Just in case that's helpful!
Damn. I hoped re-exporting the original that worked and adding the missing _CodeSignature folder from the Mac export would be a workaround, but if it needs a new signature each time then that's not an option. And I don't have access to the borrowed Mac so it could be a while before I can find a proper fix.
I think I finally figured out what happened here. I've been using Godot v3.4, but when I tried the Mac export I downloaded the latest version (v3.5, which was released a couple weeks ago). There was a slight change to how it handles inputs that caused a problem with the UI buttons. One extra line of code, and it's fixed.
As it turns out, v3.5 also fixed the issue that was preventing me from code-signing, so I should be able to push updates and troubleshoot issues for the Mac version from my own device now.