Critical Update: Require User Access to Apex Classes Invoked by Flow when running user = Automated Process

The real answer was provided by Matt over on Salesforce Success

1. Get the ProfileId of Automated Process User using Dev Console

    SELECT ProfileId from User WHERE alias = 'autoproc'
   

2. Coerce the URL that edits Apex class access for a Profile

    /_ui/system/user/ProfileApexClassPermissionEdit/e?profile_id=theAutomatedProcessProfileId
   

and you'll get the familiar dialog to assign Apex classes to a Profile.

After a call to SFDC Support, the answer seems to be:

"Call SFDC Support to enable Automated Process user access to invocable classes before enabling this Critical Update."

Clearly unsatisfactory. Let's hope Winter 20 has a solution.

UPDATE: If you do call Support, they will tell you that you can self-serve by entering the Automated Process's ProfileId 00e36000000oZf3AAE into the URL - but you'll get Insufficient Privileges if you do that whereas if Support logs in as you, they do not get an error and can see the profile.