UTM 4.7.5 (118): bundled utmctl --help exits 134; taskgated reports no eligible provisioning profiles

Environment:

- macOS 26.6.2, build 25G83 (read with sw_vers).
- UTM 4.7.5, build 118, installed at /Applications/UTM.app from the official DMG distribution.
- Developer Team ID WDNLXAD4W8 (Turing Software, LLC).
- The application passed strict code-signature verification and notarization assessment at installation. Quarantine was retained.
- This is a CLI invocation made by a sandboxed desktop automation host. The exact influence of that launch context has not been established. A targeted, approved, read-only system-context signature check subsequently passed. No elevated retry of the executable was performed.

Observed invocation (already performed once; not a request to repeat):

```text
/Applications/UTM.app/Contents/MacOS/utmctl --help
exit code: 134
stdout: empty
```

Targeted system log excerpts, local time 2026-09-10:

```text
16:10:18.552 taskgated-helper:
Disallowing com.utmapp.utmctl because no eligible provisioning profiles found

16:10:21.017 Sandbox:
utmctl deny mach-lookup com.apple.secinitd
utmctl deny mach-lookup com.apple.system.notification_center
utmctl deny mach-lookup com.apple.logd
```

Read-only bundle inspection:

- utmctl code identifier: com.utmapp.utmctl; Team ID WDNLXAD4W8.
- Three embedded profiles were found in UTM.app, QEMUHelper.xpc, and QEMULauncher.app. Their application identifiers respectively target com.utmapp.UTM, com.utmapp.QEMUHelper, and com.utmapp.QEMULauncher, with the same Team ID.
- Those profile metadata date ranges cover the observation date. No matching utmctl identifier profile was found within this bundle inspection. This is not a statement about the system-wide registered profile store or proof of the sole cause.
- The CLI signature's declared entitlements include app sandbox, the WDNLXAD4W8.com.utmapp.UTM application group, and UTM scripting targets.

No VM was created or started. We did not retry through the GUI, AppleScript, or another executable, remove quarantine, re-sign binaries, change sandbox/security policy, install/register a provisioning profile, or elevate the executable.

Could you confirm whether the official build 118 utmctl packaging and entitlements are supported on this OS and launch context, and identify the vendor-supported remediation or fixed signed release? We are seeking a supported fix that preserves macOS security enforcement, not instructions to disable protections or modify vendor signatures.

Start with /Applications/UTM.app/Contents/MacOS/utmctl --help and the read-only bundle inspection of its signature, entitlements, and embedded provisioning profiles. Compare the utmctl identifier with the profiles described in the issue and review the taskgated and Sandbox logs. Done means confirming whether build 118 is supported in this OS and launch context and identifying a vendor-supported remediation or fixed signed release.

Written by the indexing model from the issue text.