aps-environment is always development

You can't use a production certificate in debug/development. Even if you do it, then, when you 'Archive', Xcode will automatically set it to production (Apple reference). You can see this when you try to submit your app to iTunes connect for TestFlight/Review or for Adhoc deployment.

Xcode 8:

Xcode 9:

XCode 10.2:

If you change your target to "Generic iOS Device" before Archive it will set the aps-environment variable to production. If you archive with the target set to your device it will archive with the aps-environment variable set to development.

There is a known bug in Xcode whereby manually setting this to 'production' causes Xcode to display an error next to your entitlements config with a 'Fix Issue' button. Clicking this sets it back to 'development' This is not intended functionality. As I said it is a known issue and I believe I filed a radar when I first discovered it.

It has been fixed in Xcode 8.3 beta 2. In the meantime, manually set it to 'production' and then ignore the error Xcode gives you, your project will work just fine.