Automating iOS/WatchKit App Store submission - Code signing issue - ios

Question

I have a rather typical iOS 8 iOS/ObjC/Xcode 6.4 application, which includes a WatchKit extension. I have no trouble manually submitting to the App Store using Xcode using the Archive menu option.
We use a build server (Bamboo but it shouldn't matter). The build server currently automates builds and distributions through HockeyApp, but we manually build and upload to iTunes Connect using Xcode. We would like to automate the builds for the iTunes Connect, so we're certain same codebase is used for both HockeyApp and iTunes Connect (both TestFlight and App Store).
I'm having a heck of a time getting the script working for iTunes Connect, due (I believe) to the three targets that need signing (iOS app, WatchKit Extension, and Watch App).
I found this answer to a related question, which has been very helpful: https://stackoverflow.com/a/29605731. That suggests putting variables into the Provisioning Profile settings for the three targets. This works for building. But that question doesn't involve uploading to iTunes Connect, which is where I'm seeing trouble.
So my script looks like this:
APP_PROFILE="[the hex string]"
WATCHKITEXT_PROFILE="[another hex string]"
WATCHAPP_PROFILE="[one more hex string]"
First I make the xcarchive:
xcodebuild archive -project myProject.xcodeproj -scheme "myScheme" -archivePath myProject.xcarchive APP_PROFILE="${APP_PROFILE}" WATCHKITEXT_PROFILE="${WATCHKITEXT_PROFILE}" WATCHAPP_PROFILE="${WATCHAPP_PROFILE}"
which works fine. Then I export the archive to an .ipa:
xcodebuild -exportArchive -archivePath "myProject.xcarchive" -exportPath "myPath" -exportFormat ipa APP_PROFILE="${APP_PROFILE}" WATCHKITEXT_PROFILE="${WATCHKITEXT_PROFILE}" WATCHAPP_PROFILE="${WATCHAPP_PROFILE}"
which also reports success. Then I need to send the .ipa to iTunes Connect using the Application Loader's command-line tool (here I'm just verifying):
altool --validate-app -f "myProject.ipa" -u myUsername -p myPassword
which spits back this set of error messages:
*** Error: Unable to validate archive 'myProject.ipa': (
"Error Domain=ITunesConnectionOperationErrorDomain Code=1091 \"Invalid Signature. A sealed resource is missing or invalid. Make sure you have signed your application with a distribution certificate, not an ad hoc certificate or a development certificate. Verify that the code signing settings in Xcode are correct at the target level (which override any values at the project level). Additionally, make sure the bundle you are uploading was built using a Release target in Xcode, not a Simulator target. If you are certain your code signing settings are correct, choose \"Clean All\" in Xcode, delete the \"build\" directory in the Finder, and rebuild your release target. For more information, please consult https://developer.apple.com/library/ios/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html\" UserInfo=0x7fec4be78b80 {NSLocalizedRecoverySuggestion=Invalid Signature. A sealed resource is missing or invalid. Make sure you have signed your application with a distribution certificate, not an ad hoc certificate or a development certificate. Verify that the code signing settings in Xcode are correct at the target level (which override any values at the project level). Additionally, make sure the bundle you are uploading was built using a Release target in Xcode, not a Simulator target. If you are certain your code signing settings are correct, choose \"Clean All\" in Xcode, delete the \"build\" directory in the Finder, and rebuild your release target. For more information, please consult https://developer.apple.com/library/ios/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html, NSLocalizedDescription=Invalid Signature. A sealed resource is missing or invalid. Make sure you have signed your application with a distribution certificate, not an ad hoc certificate or a development certificate. Verify that the code signing settings in Xcode are correct at the target level (which override any values at the project level). Additionally, make sure the bundle you are uploading was built using a Release target in Xcode, not a Simulator target. If you are certain your code signing settings are correct, choose \"Clean All\" in Xcode, delete the \"build\" directory in the Finder, and rebuild your release target. For more information, please consult https://developer.apple.com/library/ios/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html, NSLocalizedFailureReason=iTunes Store operation failed.}"
I get the same error if I use the Application Uploader GUI.
I'm confident I'm using the correct profiles in the script, as when I export an archive in Xcode these are the three Xcode selects (that export will validate/submit fine).
I'm at a loss where to look next. Any and all help is appreciated - thanks!