Thank you for your answer. It helped a lot.
While it is not possible for us to go with Xcode Cloud, your comment did nudge me into look into what Xcode Cloud does for other apps where we do use Xcode Cloud. I got the problems with automatic signing resolved by using some of the same parameters as Xcode Cloud does.
I am quite puzzled as to why it required your comment for me to look at Xcode Cloud but that is one of the ways your work is so invaluable.
The result is
xcrun xcodebuild \
-workspace app.xcworkspace \
-scheme prod \
-configuration 'Release' \
-destination generic/platform=iOS \
-archivePath ./build/prod.xcarchive \
CODE_SIGN_IDENTITY=- \
AD_HOC_CODE_SIGNING_ALLOWED=YES \
CODE_SIGN_STYLE=Automatic \
DEVELOPMENT_TEAM=ZZZZZZZZZZ \
clean archive
and no call to codesign is necessary