So, inspired by frustration, I revisited the subject and saw it to conclusion.
Initially, GrapheneOS moved my post about this to the 3rd-party-apps forum and then later locked it. Hikvision/Annke/Guarding Vision devs never replied.
So I reverse-engineered their app, found they were checking for com.google.android.gsf (the old GSF package) instead of actually verifying FCM was working, and built an MIT-licensed patcher.
I also submitted a PR to GrapheneOS that adds a minimal synthetic GSF package presence when verified GmsCore is visible to the caller. And it's gated so it only engages when Play Services is actually installed and visible.
For now, the patcher does its job. If the PR gets merged, future GrapheneOS builds will fix this for every app that makes the same wrong GSF check, not just Hikvision stuff.
I also documented a dead-simple method for non-devs: enable USB debugging, plug your phone in, and tell an AI assistant to use the GitHub repo to patch your APK.