After working on this further, I've concluded it's impossible to use Xcode cloud for this purpose currently, unless I'm missing something. I'm actually unsure what the Notarize post-action is intended for, as there's no way to automate getting that notarized binary out of Xcode Cloud making it useless in a CI environment.
One possible workaround I tried was to remove the notarize post-action step and instead do notarization and stapling myself as part of a ci_post_xcodebuild script, however then the signing step will not produce a developer-id signed archive, it's just missing.