Found my issue: one of my earlier steps in my workflow modified the app identifier to add a .preview suffix — This way we are able to install both the preview and the app-store version on devices.
Because of this change the .plist file of course targeted the wrong app inside the provisioningProfiles dictionary. A better warning would’ve helped to locate the source of the error.
On a sidenote: strange though that the automatic generation of the .plist file inside the xcode-archive@2.4.16 step – e.g. its “generating provisioningProfiles node” part – does not detect the changed CFBundleIdentifier from the app’s Info.plist file.