Change both main app's and extension's entitlements to specify com.apple.security.application-groups of (team prefix)iTerm. I'm not sure that mattered. Remove --deep from main app, and change provider's Info.plist's NSExtensionFileProviderDocumentGroup to match the app group. It now works!