PKAddPaymentPassViewController cannot be created in TestFlight build despite entitlement being present

We are integrating Apple Pay In-App Provisioning in our banking application using an external SDK. The provisioning flow works on the iOS Simulator (mock sheet appears), but fails on real devices via TestFlight with the error:

internalInconsistency: "PKAddPaymentPassViewController can not be created"

Environment:

• Xcode 16
• iOS 18
• Real device: iPhone (tested via TestFlight / Distribution build)
• Card network: Mastercard

What we've verified:

1. com.apple.developer.payment-pass-provisioning entitlement is set to YES in our .entitlements file
2. The entitlement is confirmed present in our Development provisioning profile via security cms -D -i embedded.mobileprovision | grep payment-pass → returns <true/>
3. PKAddPaymentPassViewController.canAddPaymentPass() returns true on the device
4. The card is NOT already in Apple Wallet (0 local/remote Secure Element passes)
5. All provisioning data is present and valid (encryptedPayload, authorizationCode, primaryAccountSuffix, cardholderName)
6. The external SDK is configured successfully at app launch

Diagnostic logs from TestFlight build:

canAddPaymentPass: true
Local SE passes: 0
Remote SE passes: 0
suffix: 6165
name: [redacted]
encryptedPayload length: 1130
authCode length: 514
scheme: Mastercard
Card already in Wallet: false

Error: internalInconsistency("PKAddPaymentPassViewController can not be created")

Testing matrix:

Questions:

1. Can PKAddPaymentPassViewController fail to be created even when canAddPaymentPass() returns true? What other conditions could cause this?
2. Is there a way to verify that the Distribution provisioning profile correctly includes the payment-pass-provisioning entitlement after it has been approved by Apple?
3. Are there any additional Apple Pay entitlements or configurations (e.g., Wallet merchant setup, pass type identifiers) required beyond com.apple.developer.payment-pass-provisioning for In-App Provisioning to work?
4. Does regenerating the Distribution provisioning profile on Apple Developer Portal resolve cases where entitlements were added after the profile was originally created?

Any guidance would be greatly appreciated. Thank you.