Provisioning profile doesn't include signing certificate / doesn't match bundle identifier

The provisioning profile Xcode selected was generated for a different certificate, an older bundle ID, or is missing a capability you just enabled (each capability change invalidates existing profiles). Manual signing setups rot fast; CI machines with cached profiles are another classic source.