I eventually figured out what was happening.
After re-reading the provisioning profile tech note, my eye caught on the paragraph which says that previously the user would install a provisioning profile accessible through the Settings on the phone, but modern iOS applications should have their provisioning profiles inside the app bundle in a file called "embedded.mobileprovision".
In iOS 16.1, in the settings, I see provisioning profiles for things like Apple's beta software, but haven't gotten iOS 16.1 to install a new application profile. Perhaps that functionality has been removed? YMMV.
At any rate, being thoroughly modern (ha!) my application, when built, should contain an "embedded.mobileprovision" file. But upon digging in the DerivedData folder and looking in the app package - it didn't. Odd.
I looked at the build transcript and clearly saw a step that was supposed to put that file into the bundle.
So then I looked at our build phases. To make a long story even longer, our application has a history that includes Ionic/Angular and Cordova. There was a script that copies the Ionic/Angular html files into the app bundle. I speculate that you use the Cordova build process then it will build the application using Xcode, then delete the signing that Xcode has done, copy the www folder into the bundle, then re-sign the result.
Since we don't use the whole Cordova build process, the script was copying in the www files, then deleting the code signing, including the embedded.mobileprovision file... but need replacing it.
I deleted the Cordova script, used a Copy Files build phase to get the HTML into the bundle, and let Xcode code sign the application.