Answering my own question here with a post that bubbled up from a few years ago:
TLDR:
- should still upload a development certificate to Code Signing tab
- without this (according to discussion in linked thread) a new dev certificate would be created for each new build, which is typically not what you want.