What a difference a day makes! Overnight a very kind person from cyberia/eu answered my Mastodon plea and gave me multiple ways to achieve my goal. They also confirmed that my problem with the custom shortcode approach is a current known bug in WordPress core.

Since I already had the child theme set up, I followed their advice to use the new Block Bindings API. I made one small change in the callback function to check if the user is logged in before displaying the link. It works perfectly! No need for the Tampermonkey hack anymore. 🙂

For the sake of posterity, here’s what I put in functions.php:

<?php
add_action( 'init', function() {
  register_block_bindings_source( 'webgoddess/edit-link', array(
    'label' => __( '[Edit]', 'webgoddess' ),
    'get_value_callback' => 'webgoddess_editlink_binding'
  ));
});

function webgoddess_editlink_binding() {
  if (is_user_logged_in () ) {
    return '<a href="' . get_edit_post_link($post->ID) . '">[Edit]</a>';
  } else {
    return;
}
?>

And here’s what I put in my template where I wanted the link to appear:

<!-- wp:paragraph {"metadata":{"bindings":{"content":{"source":"webgoddess/edit-link"}}}} -->
<p>[Edit]</p>
<!-- /wp:paragraph -->