The prior force:true fix only touched the main app's profile and let
sigh name it '<bundle id> AppStore' - a different name than the one
manual signing expects (PROVISIONING_PROFILE_SPECIFIER = 'LC Prov
PediFoods Dist Profile' / 'LC Prov PediFoods Dist Push Profile', baked
into PediFoods.xcodeproj per target). Xcode resolves profiles by exact
Name match against installed .mobileprovision files, so it never found
sigh's freshly-created one and kept falling back to the stale,
wrong-certificate profile under the old name - the extension's profile
was never touched at all, since sigh only acts on the app_identifier
it's given.
Added renew_provisioning_profiles (shared by beta and release), calling
get_provisioning_profile once per target with an explicit
provisioning_name matching what the project actually expects, plus
force: true so each is regenerated against the team's current
certificates.