Thank you for the suggestions, here are my results:
Exporting
In order to export my app archive through the organizer, I followed these steps: Xcode 16 -> Organizer -> Distribute App -> Custom -> Direct Distribution -> Export -> Automatically Manage Signing -> Export.
Notarytool + Log
After exporting, I followed Customizing the notarization workflow in order to run notarytool. You were right, the process was easier than I thought that it would be. After running notarytool, I was able to get the log file from the failed notarization by running xcrun notarytool log .... I have attached the log file below.
Case Sensitive Volume
I created a case sensitive volume using the disk utility app. After copying over and unpacking my app, I re-ran codesign --verify --strict --deep -vvv …, which produced different results than my original debugging session. The output was a lot shorter than my initial run (maybe from detecting the issue?). This seems to be the issue from the output:
--prepared:/Volumes/Notarization Testing/MYAPP.app/Contents/Frameworks/grpcpp.framework
/Volumes/Notarization Testing/MYAPP.app: code has no resources but signature indicates they must be present
In subcomponent: /Volumes/Notarization Testing/MYAPP.app/Contents/Frameworks/grpcpp.framework
Extended Attributes in Zip Archive
I checked for extended attributes by running unzip -l MYAPP.zip | grep -E "__MACOSX|._" and the output was empty. I also ran unzip -l MYAPP.zip while manually checking and noticed no directories or files with these prefixes. Also when signing through the organizer, these files + directories seem to automatically get stripped if they happen to be in the archive, though I might be wrong about that.
Conclusion
From this debugging session, it seems that the issue stems from the new output received when debugging the code signing on a case-sensitive volume. The error seem to be "code has no resources but signature indicates they must be present" for grpcpp.framework. Which I'm not sure exactly what that means at the moment besides that it is from an external package. I'll do some more research and see if I can resolve that.
developer_log.json