Therefore, I ask: how does one tell the difference between software that can and cannot surveil?
So most useful record-keeping software can be used for surveillance. Most software capable of inferring data about the real world from sensors can also be used for surveillance.
Most likely a better ethical framework for talking about surveillance is "how can surveillance (its components, owners, operators, and consumers) be identified in practice and what are its effects?" Surveillance is a subset of knowledge, and most knowledge is both useful and amoral. The use of knowledge for unethical things is the problem, not the knowledge itself.
Names, for example, are probably the oldest technology for surveillance; used since pre-history to refer to specific real people and data about them such as the names of locations they reside in or visit. No one blames names for the effects of surveillance.
Which I think most would agree is the standard definition of surveillance, and I also think the concept of being surveilled comes naturally to most, which is why parties that surveil people make clear efforts to obfuscate the fact that they do so.
These technologies can incarcerate people. It’s really important to dive onto the slippery slope and find out where it’s stable.