@Quinn Thanks for the walkthrough. I did discover old Provisioning Profiles and deleted, as you suggest. Everything looks great per your tests — application-group is showing up in all my profiles — but submitting to ASC still fails with the same error. I've tried both manual and Xcode-managed profiles.
It is unusual case: I have a Mac Catalyst app with a non-Catalyst Mac app embedded as a Login Item, which itself has a Mac share extension embedded. It's the two Mac apps that are failing.