You are correct that the profile from step 3 has no entry for key-value storage. However, the profile from step 5 still uses the old team ID.
One thing I realized while looking at this is that I'm still a member of the old team. That team's developer subscription is no longer active but I'm still a member. I almost left it when I realized but decided to only follow the steps you suggested.
Step 3 (iCloud not enabled)
"Entitlements" => {
"application-identifier" => "TEAM_ID.com.ORGANIZATION.APP"
"aps-environment" => "production"
"beta-reports-active" => true
"com.apple.developer.team-identifier" => "TEAM_ID"
"com.apple.security.application-groups" => [
0 => "group.ORGANIZATION"
]
"get-task-allow" => false
"keychain-access-groups" => [
0 => "TEAM_ID.*"
1 => "com.apple.token"
]
}
Step 5 (iCloud re-enabled)
"Entitlements" => {
"application-identifier" => "TEAM_ID.com.ORGANIZATION.APP"
"aps-environment" => "production"
"beta-reports-active" => true
"com.apple.developer.icloud-container-development-container-identifiers" => [
0 => "iCloud.ORGANIZATION.APP"
]
"com.apple.developer.icloud-container-environment" => [
0 => "Production"
1 => "Development"
]
"com.apple.developer.icloud-container-identifiers" => [
0 => "iCloud.ORGANIZATION.APP"
]
"com.apple.developer.icloud-services" => "*"
"com.apple.developer.team-identifier" => "TEAM_ID"
"com.apple.developer.ubiquity-container-identifiers" => [
0 => "iCloud.ORGANIZATION.APP"
]
"com.apple.developer.ubiquity-kvstore-identifier" => "OTHER_TEAM_ID.com.ORGANIZATION.APP"
"com.apple.security.application-groups" => [
0 => "group.ORGANIZATION"
]
"get-task-allow" => false
"keychain-access-groups" => [
0 => "TEAM_ID.*"
1 => "com.apple.token"
]
}
