There was an ejabberd apparmor profile which was preventing this service from starting. ejabberd was inactive on my FreedomBox and unused for a long time. GUI removal of ejabberd removed the apparmor profile which was causing the service to fail.
You can diagnose a problem such as this by using the logs applet in Cockpit.
Starting with this log entry…
I knew I needed something related to ‘su’. This command helped me find the suspect apparmor profile (does not need root):
/sbin/apparmor_parser -N /etc/apparmor.d | grep su
The output from this included /usr/sbin/ejabberdctl//su which lead me to uninstalling ejabberd.