I can tell you my experience with a Camera extension, and with a USBDriverKit extension.
I believe the requirement that the kext's bundle ID begin with the bundleID of the hosting app is for iOS/iPadOS only. There isn't such a restriction for the dexts that I know about (but networking or security extensions might have different rules). That said, I see that I actually obey that rule with my projects, and it doesn't do any harm.
Your dext has a managed entitlement for PCI. Your Account Owner has to make a profile for that on the developer portal - an Admin can't (but won't see a helpful error message, last time I tried as an Admin).
You can leave all the Xcode settings that are working for development as they are. Try not to fiddle with Info.plist files or Build Settings directly if there is a way to set the same settings using the Info tab for your target, or the General tab, or the Signing and Capabilities tab, because those feed into the Build Settings.
in my main app and dext targets, the Provisioning Profile is "Xcode managed profile" and the Signing Certificate is a Development one. That's fine, it is all going to re-signed for distribution.
When you want to build for distribution from Xcode,
archive your build.
choose Distribute
choose the Custom distribution method
select Direct Distribution
select the Export destination
use the Manually Manage Signing option
at this point, you'll be able to choose a Developer ID Application certificate, and the appropriate profiles for you app and its extension.
If you're doing all this from a script, you have to figure out what the right commands are which correspond to the steps in the dialogs.
Good Luck!
I can't take you any further with this, because I gladly ceded signing and notarizing tasks to our DevOps team, so I don't have the signing certificates with the private keys on my Mac.
AFAIR, I selected "None" for my app's Profile, it doesn't need anything special, while the driver has managed entitlements and I do need to set its profile explicitly.
After a successful signing step here, you can use notarytool to notarize the app, and attach a ticket to it.
There's a post from Kevin Elliot here about this https://forums.developer.apple.com/forums/thread/751490?answerId=787624022.