In a perfect world, it would be the exact same build.
The problem is that automating iOS apps requires adding an HTTP server to the app so your test scripts can communicate with the app. Without this piece, cucumber will be unable to talk to the app.
For that reason, you don't want to submit this build to apple: your users would have an open HTTP server accepting synthesized events on their phones, you can imagine what a bad person could do with this knowledge.
You are right that it somehow taints the app - but the changes are extremely unlikely to affect the regular build of the app - it's basically adding a few classes and the HTTP server that listens to incoming traffic.
As for the CI - just build two apps in your build tracks: the regular production app and the automatable version. When Automation signs off the automatable build, send the production app to apple.
/kra