Follow @macgreg on Micro.blog.
PSA: You can set Hardened Runtime entitlements without being sandboxed. Just don’t set Enable Hardened Runtime in Build Settings. Use the Capabilities tab instead. It will set the Enable Hardened Runtime build setting for you. Magic.