Thank you for your super detailed answer! And, oops, sorry about missing (or probably forgetting about) these warnings in the docs.
I've been looking into various solutions, mostly gravitating towards the “symlinks for gnarly edge cases” solution. However, I ran into something perplexing:
If I create an archive build within Xcode, then submit it using “Direct Distribution”, the process fails with a “The signature of the binary is invalid.” issue.
But! If I then submit this same, archived .app, using notarytool, this submission then succeeds!
Is this what you were referring to, when mentioning Xcode being persnickety? I don't understand the implications here—is Xcode performing the notarization submission differently? Is it OK to just rely on the command line for notarization?
Here's how I submit via Terminal. I'm using the same AC profile in both cases:
xcrun notarytool submit --keychain-profile "AC_PASSWORD" --wait ZippedArchivedApp.zip