Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

Maybe make timemachine backup before install, install only your app, try if timemachine restore can reset trial. Or compare filesystem before app install with after, see below.

Very technical way: try find every file
open/create during install or run. Linux has strace, macos has dtrace/execsnoop but depend on macos version difficult to setup. Then dump trace for all file operation (open/write/rename/...), find filepath from trace, try delete file that outside of directory you already try to delete. Prepare you might brick mac or not allowed because of tight security.

If not show any other file maybe also syscall trace useful if kernel give "uuid" to program. Also maybe macos has better way to debug app, like gdb maybe, and try to find all call to open , then intercept and log filepath like that.

Or install fresh system, take apfs snapshot (apparently possible using tmutil, or just make timemachine backup but iirc those not backup all file of system so might miss some), install only your app, take apfs snapshot, mount both snapshot and compare to find all change/new file. Maybe rsync -avin newsnap oldsnap for metadata compare or rsync -avicn newsnap oldsnap for content checksum compare (if actually change content without metadata somehow) or snapshot or backup diff using other program, i think timemachine could show backup diff somehow.

Edit: also wireshark for intercept and inspect network traffic.