Ah ha !
As well as using a the …aarch64… download, the first boot is “expected” to fail and you have to go in and manually disable secure boot (see Installing HA OS 12.2 in a virtualized KVM (virtual manager) using rasperry PI 5 and Rasperry pi OS not working - #9 by vmariniferreira)
Is there a process for tweaking the install docs to hint at this ?