So here’s what I have figured out so far:
First, the UUID of all of these services follow the format of <a22b????-ebdd-49ac-b2e7-40eb55f5d0ab>, with ???? ranging from 0010 to 0230. blescan -d provides these addresses as well as the handle addresses that gatttool needs. So here are the ones I have figured out so far:
0010 = Battery level. appears to be 100%. Will know more as my batteries die. 
001f (a22b0010) = system clock of some sort
002e (a22b0080) = “Reverse” inverted bit: 00 for normal orientation, 01 for inverted. Will toggle switch to match the current on/off state with respect to orientation.
002b (a22b0070, read/notify only) = status bit: 00 for off, 01 for on
0030 (a22b0090) = toggle bit: just write to it to toggle state, doesn’t matter what.
0029 (assb0060) = toggle / reset?: when read, value is always 00, but when 01 is written to it, switch toggles and BT connection to device is immediately dropped
0021 (a22b0020) = state of Timer 1. This is a 12-character hex address and encodes the time / day settings from the app.
0023 (a22b0030) = state of Timer 2. Same as above.
0032 (a22b00d0) = state of Motion Detection timer. Same as above.
The one thing I can’t find from the app is the Welcome Home settings; which makes sense, since it’s based on location detection of the phone so why not save that info in the app and trigger as necessary. I am sure that the timer stuff could get hashed out with enough poking at it and changing settings and seeing how the value changes.
Makes me wonder what 0025 (a22b0040) is for, since it’s a 12-character writable field but doesn’t seem to have a corresponding setting.
So that means my command-line switch is imperfect, since both on “on” and “off” commands will toggle the switch. I need to figure out a template that will decide whether to actually send a toggle based on the current state of the switch, which I am sure is doable, I just need to find out how to do it. Right now I use these two commands to track state:
command_state: "gatttool -b C0:12:DF:CB:B3:23 -t random --char-read --handle=0x002b | cut -c 35"
value_template: '{{value == "1"}}'