Most of these answers seem complicated and out dated. I think the simple answer is to make an archive with a Developer profile.
This is a solution which I am currently investigating for my own purposes (not fully tested):
You just need developer access (not team agent) to their account and create a Development provisioning profile that authorizes you to build the specified App ID (you need to specify the App ID, because it gets compiled in). Then Archive the app with the Development profile, and share the archive with your client. They can then re-sign the archive with their own Distribution profile.
One complication is that when you build an archive with a developer profile, the entitlement attribute get-task-allow gets set to true, but needs to be set to false for distribution, so you have to work around that by setting it manually your Entitlements.plist – see my question here: Can I archive with a Developer certificate, then re-sign it during submission with a Distribution certificate?