Sadly, I closed this PR because I realized I only had the right version numbers because the build machine was running Big Sur. I think the only fix for this will be to upgrade the build servers on Osquery to use Big Sur.
there is probably an ugly hack that can be employed
but for whatever reason setting the magic ENV var from within the process itself is not the same as the caller setting the ENV var when invoking osquery. I don't understand why that is the case... I tried setting the ENV at osquery startup in init.cpp and right before the plist is queried...but no love.
I gave up because I couldn't be sure how my Mac being on Big Sur was impacting my ENV experimentation. Whatever magic Apple is employing...it's something in the kernel itself and I don't think that source is available