In my original post I was mistaken regarding changing the bundle id – my original bundle id has the issue, but if I change it (and tab out of the field before building) then it will run with a different bundle id. With my original bundle id, In console, it logs: "Client com.apple.runningboardd trying to look up container 2:com.getkeyfree.keyfree.rental-test with ambiguous user identity" and attempts to read various files from the root home directory, e.g.: /private/var/root/Library/Containers/com.getkeyfree.keyfree.rental-test/.com.apple.containermanagerd.metadata.plist However, after deleting all provisioning profiles locally from ~/Library/MobileDevice/Provisioning Profiles/, deleting my certificate from the developer portal, and attempting to get Xcode to recreate the provisioning profile, it still doesn't work.

Uploading with fastlane (i.e. iTMSTransporter) seems to work.