A private company has establishments in France, Poland, the United Kingdom, and most prominently, Germany,...

Under the GDPR, the lead supervisory authority is determined by where the main establishment related to the processing activity is located.

In this case, even though the company's headquarters is in Germany, the SaaS application was specifically defined and implemented by the Polish establishment. This indicates that the Polish establishment has the primary role in determining the purposes and means of processing personal data related to that SaaS service. Therefore, the supervisory authority of Poland would be the lead supervisory authority for this specific processing activity.

References:

GDPR Article 56 - Competence of the lead supervisory authority

IAPP CIPP/E textbook, Chapter 3: EU General Data Protection Regulation (specifically, sections on One-Stop Shop mechanism and lead supervisory authority)