Settings Crashes After DC Promotion; Windows Update Unavailable (Server 2016/2022)

Your isolated test is very useful: the same server works as a member server and breaks the moment it becomes a domain controller, and it works again after demotion. That means the cause is something that applies only to domain controllers, not the Settings app itself. Both the app crash and the Access denied (0x80070005) from the standalone installer fit a permissions or security policy problem. What I would check, in this order:

• Which account you use. On domain controllers the built-in Administrator is the usual case. Store apps such as Settings often will not start for the built-in Administrator unless Admin Approval Mode is on. Test with a different domain admin account, and check the policy User Account Control: Admin Approval Mode for the Built-in Administrator account (it should be Enabled) and Run all administrators in Admin Approval Mode (Enabled).
• The policies that only apply to domain controllers. The Domain Controllers OU gets the Default Domain Controllers Policy and often a hardening baseline. Run gpresult /h c:\gp.html on the DC and look at the User Rights Assignment and file system or registry permission settings applied. Removing groups such as Authenticated Users, ALL APPLICATION PACKAGES or ALL SERVICES from the right places can break Settings and the installer. Compare secedit /export /cfg c:\sec.inf on the DC with the same export on your fresh member server, and the differences will show you which setting it is.
• The logs. Check Event Viewer > Windows Logs > Application for a SystemSettings.exe crash (note the faulting module and exception), and Applications and Services Logs > Microsoft > Windows > AppModel-Runtime for the activation error. For the installer, look at C:\Windows\Logs\CBS\CBS.log and run the update package from an elevated prompt.
• Updating while you fix it. You do not need the Settings app to patch a server: sconfig option 6 downloads and installs updates, PowerShell (the PSWindowsUpdate module) works, or use your WSUS or update management tool, and dism /online /add-package works for a downloaded cumulative update from an elevated prompt.

I would avoid demoting the DCs as a workaround. The comparison of the policy exports will usually point to the setting, and the GPO can then be fixed for good.