Turns out Passenger assumes and requires a /public folder.
This app is so tiny and new, it didn’t have one yet – so I was pointing Passenger at the app’s root. Resulting in the 403 errors.
Solution: Create an empty /public folder and restart Apache. Ta Da. Like magic.
If you’re still having issues – confirm your LoadModule passenger_module path is correct, mine looks like this:
After updating the Passenger gem to 2.2.7, my LoadModule path was way off, not helping the deployment troubleshooting efforts.