So my attention turned to the production app and its permissions/entitlements. There was clearly nothing wrong with the code, but perhaps it hadn't been signed properly?
In Xcode's Organizer there is no way (as far as I can tell) to recover the ipa file that was submitted to Apple using the 'Submit' button, so instead I went to the App Store on my mac and downloaded the live production app. In Finder, I changed the .ipa file to a .zip, and opened up the package contents. In the 'payload' directory is the app file. With this, I checked the entitlements like so:
codesign -d --entitlements :- "Payload/YourApp.app"The response showed that there were no APS entitlements. I compared it to a known working .app file, and the following entry was missing:
<key>aps-environment</key>It seems that at some point the app was submitted with the wrong Distribution Profile. If it only it wasn't Christmas holidays at iTuneConnect!