@rakhsh thank you! SG security was indeed causing the error.
However, Create Block Theme will still not recognize the theme.json file in the child theme. The theme.json was updated by the plugin, it correctly lists the fonts, but they are not visible in Manage Theme Fonts.
I have disabled ALL the plugins on the staging server, leaving CBT as the only active plugin. No modifications I make to the child theme.json are reflected in the site, not just the fonts.