My App was released on the App Store a year ago, and used an XCode 5 compatible iCloud container that had the ID
ITMS-90163, 'the bundle contains a key that is not including in the provisioning profile'
I eventually found that Apple has moved all old iCloud containers
TEAM_IDENTIFIER_PREFIX.com.company.name to use the new naming format
I just used the new container in XCode 7 and everything worked correctly, and I could submit the App.
I'd been thrown off because (A) this does not seem to have been explicitly documented anywhere, and (B) there are some other answers on Stack Overflow that explicitly state that the two differently named iCloud containers are not the same, which does not appear to be true.