Xcode archives successfully using the latest - and correct - provisioning profile.
However, the Bots configured in Xcode Server still use an older profile.
This can be seen if one authenticates as xcodeserver user and navigates to ~/Library/MobileDevice/Provisioning Profiles.
Running security cms -D -i myuuid.mobileprovision confirms this.
Having tried reconfiguring a new Bot, restarting Xcode Server, deleting the old profile, and so on, nothing works.
How can we help Xcode 9 Server do what it promised, and use the latest provisioning profile from the Apple Provisioning Portal?
A dirty hack will work. This is assuming Xcode will correctly Archive using the correct profile. Unarchived the resulting .app file, then rename the embedded.mobileprovision file according to it's UUID, e.g.
myuuid.mobileprovision
Next, copy myuuid.mobileprovision to the ~/Library/MobileDevice/Provisioning Profiles folder.
Identify any older profiles linked to the same bundle identifier and delete. To play it safe, consider moving temporarily to ~/Desktop.
Finally, integrate the Bot, unarchive the resulting .app., and inspect to confirm creation expiry date, UUID, and UDID array are all as expected:
security cms -D -i embedded.mobileprovision