I just discovered in the technology limitations of App Clips that CloudKit is out. It isn't in the list of 'supported capabilities' in the project editor. Additionally, as one would expect, trying to create a CKContainer without the entitlement in the App Clip target crashes with a fatal error due to the lack of that very entitlement. This feels unnecessarily restrictive and excludes developers from supporting App Clips who build their server tech stack on CloudKit.
Write capability isn't needed for my concept. Effectively I'd want for each unique venue to be able to continue to manager their menu/venue via CloudKit + Security Roles and allow updating content in the main app--and for users to view/browse with focused location/venue specific menus in the app clip. As recommended, the full app has to be installed for the full experience.
I'd rather not attempt to hit the public database via the JS library, or making an API proxy that just invokes CloudKit web tech under the hood. I really think supporting read operations from the public CloudKit database would enable many experiences that are currently restricted due to this limitation.
If someone at Apple is watching, I created FB8528010 feature request with a little more details on my new feature concept.