Answer
The correct sequence is: RMB the LTU permission set and choose Remove License Connection (this prompts to convert affected users to Full License temporarily — confirm that), make your grant changes to the now-unlinked permission set, re-export it as an LTU permission set, send the exported file to IFS's License Generation team for a new license key, then apply that new license in Production. This full cycle has to be repeated every time you need to add or remove a grant from an LTU-connected permission set — there's no lighter-weight way to modify one while it's still actively license-connected.