An assert won't run in production/snapshot code, so if eg someone testing a snapshot or RC tries running with JDK24, they will get a nasty error from trying to use SM below. Could we make this more explicit with a helpful error message?

That like will always be true unless we make a change to code - the change in your PR ensures it. I added the assert to protect against ourselves (if we change something, and open the possibility of having neither, things in CI would start to fail).
I can make the change if you want of course, but no one should ever see that error message.

Perhaps I'm still missing something: wouldn't a user that say uses a custom JVM of 24 on a snapshot of 9.0 beta hit this?

We already guarantee we use entitlements when we have a JVM 24:

final boolean useEntitlements = RuntimeVersionFeature.isSecurityManagerAvailable() == false || entitlementsExplicitlyEnabled;

(initPhase1)

So with 24 we always hit the entitlements branch.
The assert is here in case we change that logic and we don't realize it, leaving us uncovered again, but it is not strictly needed.

Ah, thank you! That's what I was missing.