we already had a ".entitlements" file for our extension with not much in it though. we followed your recommendation and added a capability, in our case an app group which we actually kept empty. it did the trick.. quite a work-around which I hope will be addressed.