I solved the problem by editing the entitlements file directly, replacing
<key>com.apple.security.app-sandbox</key>
<true/>
with
<key>com.apple.security.app-sandbox</key>
<dict>
<key>user-preference-write</key>
<true/>
</dict>
Unfortunately, Xcode's capabilities UI does not support the change.