BMS disconnects when battery voltage gets too high. With no load, voltage on BMS rises uncontrollably. That is where a crowbar circuit would work. In this case you don't need such a sharp knee in the sense circuit. If on battery side of SCC, needs to be low enough leakage at proper voltage to avoid draining battery.
You could design a circuit to detect something like 20V for 12V battery, and trip a crowbar. The crowbar needs to latch closed, so it doesn't toggle on and off like a typical relay would. There are latching relays, and there are SCR. You could also consider using a 2-pole breaker as a crowbar relay.
As I mentioned, I thought about mechanically tripping the PV breaker to open it. Then I thought of putting over-current through one more pole of a ganged breaker. Assume you had three PV strings combined in parallel. Use a 4-pole breaker and route a suitably high current source to the 4th pole, shorting it out in order to trip the breaker.
A few issues making this work. If you route the combined PV wire to that breaker, it would only trip same rating breaker under full sun conditions, and only after a delay. Would need a lower amperage rating to trip fast in full sun. Under partial sun could still be slow. If feeding circuit from battery, BMS has already disconnected. Need to bypass BMS or use other battery to supply trip current (in my case, AGM so not disconnected.) Breaker needs to withstand short-circuit current available, so maybe use a series resistor.
SCR circuit seems the cleanest electrically. Needs to be heatsinked to carry Isc while in the conducting state (perhaps a volt or so across SCR.)