Preserve macOS app bundles in `dist` folder as part of packaging/notarization

### What is the problem or limitation you are having?

On macOS, the notarization process can take time. This means it can be necessary to start a notarization request, and resume it later (see #2886).

DMG and PKG installers are generated into the `dist` folder, and notarized in that location. When notarisation is CI is performed in CI, and needs to be resumed, it's easy to preserve the state of the `dist` folder as a CI artefact and restore that CI artefact for subsequent resume runs.

However, .app bundles are bundled into a temporary zip file for notarization, the credentials stapled onto the app, and a final .zip is created. The .app bundle remains in the build folder, which means it's much harder to restore the state of notarization - you have to preserve the full state of the `build` folder, not just the `dist` folder.

### Describe the solution you'd like

The packaging of *notarized* `.zip` apps should copy the .app file into the `dist` folder as part of the initial packaging process, and build a zip file of the .app bundle as part of packaging finalisation. This means the `dist` folder will contain both a .app file *and* a .app.zip file on completion - but in an interim state, the dist folder will only contain the .app bundle.

### Describe alternatives you've considered

* Status quo.
* Only preserve the .app file as part of an interrupted notarization run. However, this complicates implementation as the location of the app isn't consistent across all behaviours.

### Additional context

The core of this will be modifying `notarization_path()` for .zip to point at the .app file in the dist folder. For DMG and PKG installers, the notarization path and distribution path remain the same.

The extra steps needed then involve copying the app bundle from the `package_path` to the `notarization_path`.

I would also expect to see that at the end of the package process, we would end up with *both* the notarized .app *and* the .zip in the dist folder. The "clean_dist_folder" process should delete *both* files.

Start with notarization_path(), package_path, and clean_dist_folder in the packaging and notarization flow. Trace how .app bundles move between the build and dist folders, then verify that interim and completed states retain the app and zip and that cleanup removes both files.

Written by the indexing model from the issue text.