@Anondoe SOLVED!! Now that I figured out what qrexec is doing, it was pretty straightforward debugging to realize that it was just a matter of permissions on the file called by qrexec
sys-usb~$ chmod +x /usr/local/etc/qubes-rpc/trezord-service
That’s it. I guess that wasn’t necessary in earlier versions of qubes, which semes weird in retrospect.
And thanks for the working example @unman 