Permanently punching through Flatpak Sandbox (how do you get "dynamic" read/write access?)

The paths selected by the Gtk.FileDialog are not using the same system as the filesystem permissions you set in your manifest.

Filesystem permissions are set before an application is run and their paths are bind-mounted into the sandbox on startup.
Gtk.FileDialog however uses the Document portal, which can grant access to paths during runtime. However, these files are mounted in the Document portal path run/user/1000/....

Paths granted over the Document portal using the file dialog stay accessible over this path, even over restarts of the application. But since they are dynamic permissions managed over the portal, they do not show up in the static filesystem permissions. And Flatseal only shows the static filesystem permissions.
If you wish to check what paths your application has been granted access to over the Document portal, you can use flatpak documents $APP_ID.

There is an API you can use to retrieve the host path for paths accessed over the Document portal as well. See a previous comment I made about it for more details.

I hope that clears things up a bit.