If you run "codesign" on your executable, it tells you exactly what the problem is:
/tmp $ codesign -vv -R="anchor apple generic" renderrob.app
renderrob.app: unsealed contents present in the root directory of an embedded framework
In subcomponent: /private/tmp/renderrob.app/Contents/Frameworks/Python.framework
If you explore that framework using Terminal, you'll see what it's complaining about:
/tmp $ find /private/tmp/renderrob.app/Contents/Frameworks/Python.framework
...
/private/tmp/renderrob.app/Contents/Frameworks/Python.framework/Versions/._Current
/private/tmp/renderrob.app/Contents/Frameworks/Python.framework/._Resources
/private/tmp/renderrob.app/Contents/Frameworks/Python.framework/._Python
Remove those files and try again:
/tmp $ rm /private/tmp/renderrob.app/Contents/Frameworks/Python.framework/Versions/._Current
/tmp $ rm /private/tmp/renderrob.app/Contents/Frameworks/Python.framework/._Resources
/tmp $ rm /private/tmp/renderrob.app/Contents/Frameworks/Python.framework/._Python
/tmp $ codesign -vv -R="anchor apple generic" renderrob.app
renderrob.app: a sealed resource is missing or invalid
file added: /private/tmp/renderrob.app/Contents/Resources/lib/python3.11/._site.pyc
file added: /private/tmp/renderrob.app/Contents/Frameworks/._libmpdec.4.dylib
Almost there. Keep removing those dot files...
/tmp $ rm /private/tmp/renderrob.app/Contents/Resources/lib/python3.11/._site.pyc
/tmp $ rm /private/tmp/renderrob.app/Contents/Frameworks/._libmpdec.4.dylib
/tmp $ codesign -vv -R="anchor apple generic" renderrob.app
renderrob.app: valid on disk
renderrob.app: satisfies its Designated Requirement
renderrob.app: explicit requirement satisfied
Now you're good to go. Or at least, ready to notarize.
Something in your toolchain is trying to create resource forks inside a zip file incorrectly. Are you building some of this on a non-Mac platform? I made a point to double-click your zip file to unzip using the expected procedure. I think you can use "ditto" on the command line to achieve the same result, but not "unzip". When using Finder, I shouldn't ever get those kind of dot files. (And for the record, they aren't even correctly structured dot files.)
I understand a lot of internet folks don't like Xcode. I've got a long list of Xcode complaints myself. But I still use it because, even at its worst, it's better than anything else. I have a very complex project under development that was designed to use some of the most gnarly Linux/open-source build platforms ever known. It's bit the bullet and took the time to port it all to Xcode. It just insane how much better Xcode is at this. Those poor Linux masochists have no idea.
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles