I threw in the towel today.
After some success setting up a complex monitoring system consisting of a LaunchAgent that automatically starts an instance of FileMonitor targeting my vault folder whenever Obsidian is launched (tracking all file activity and parent process with millisecond accuracy) plus a Hammerspoon pathwatcher that automatically logs and pops up alerts in realtime if any 0 byte files are detected in the vault… I thought I was finally on course to track this down.
And then Apple’s endless obfuscation bit me in the rear again: seems that files modified in iCloud on other devices (phone, another laptop etc) trigger file changes in a way that bypasses traditional logging methods. I posted a github issue here and a crosspost on StackExchange as well.
I moved my vault out of iCloud and am just syncing with Syncthing for now. Will probably switch to Obsidian Sync when the mobile app exits beta.
TL;DR— At this point I personally consider iCloud unusable for any important data storage.