GraphQL private schema returning public schema scope
It turned out that MAMP Pro was stripping out the Authorization header, so every request was treated as a request to the public schema. The solution for MAMP Pro was to enable "Identical PHP version for all hosts (module mode)" in the PHP tab.

Thanks to Brandon Kelly from the Craft forum for pointing me in the right direction.