I went back and recreated my .p12 files and .mobileprovision profiles according to the suggested articles to make sure they were all related:
How to make a p12 file for iOS
How to make a mobileprovision file
After adding a sufficiently secure password for my distribution and push notification certs, I got a build error like this one: Enterprise Build failed.
I found:
… we have more detailed logs which we intentionally don’t show to users, it turns out that you uploaded wrong provisioning profile. It’s not associated with distribution certificate you provided us with.
After looking through there, I checked my provisioning profiles to make sure they were all related and they were. It turned out that the bundleIdentifier in the app.json had a typo and I was trying to build for a different app ID than the certs/mobileprovision were made for.
Hope that helps!