Update: XU4Q heatsink arrived. This is a fully passive solution.
I used Artic MX-4 as thermal interface.
Test: nbench, 4 threads, infinite loop: while [ 1 ];do ./nbench;done
Ambient temp: 24C for both tests.
Time: checked both at 15m mark.
From /sys/class/hwmon/hwmon0/temp1_input
w/o heatsink: 72282 (72.3C)
w/ heatsink: 55807 (55.8C)
It seems to do the job, no fan needed.
There is some 1-2mm clearance, eyeballed, from the height of the M.2 screw to the heatsink retaining clips.
edit: I have now installed an SSD (Patriot P300) w/o issue.