Drop --no-unsign and bump RP_SHA to 8ee72fe

The --no-unsign flag was disabling relocatable-python's own
fix_broken_signatures step (locallibs/fix.py), which ad-hoc re-signs
every binary modified by install_name_tool before ensurepip runs.
That's the exact code path needed to satisfy Apple Silicon Gatekeeper.

The flag's stated purpose ('don't touch the python.org signature') was
never achievable — install_name_tool invalidates the signature whether
you tell relocatable-python to handle it or not. Keeping --no-unsign
just left the binary in a broken signed state, which Gatekeeper SIGKILLs.

Bumping RP_SHA to 8ee72fe simultaneously, since the prior pin
(fb4dd9b) had the same code path and was only kept while investigating.
The newer SHA additionally sets CPPFLAGS for pip, useful for packages
with native extensions.

Closes the local equivalent of gregneagle/relocatable-python#32 for our
build pipeline.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

build_python_framework_pkgs.zsh

@@ -9,7 +9,7 @@
 set -eu
 
 # --- Pinned upstream commits ---
-RP_SHA="fb4dd9b024b249c71713f14d887f4bcea78aa8b0"  # gregneagle/relocatable-python
+RP_SHA="8ee72fe3a5dbef733365370ebf44f25022b895ef"  # gregneagle/relocatable-python
 MP_SHA="bbd07730d1b93ed3828246575ef5676bba74b5d1"  # munki/munki-pkg
 
 # --- Paths and constants ---
@@ -132,7 +132,6 @@ build_framework() {
         --python-version "${PYTHON_VERSION}" \
         --os-version 11 \
         --upgrade-pip \
-        --no-unsign \
         --pip-requirements "${TOOLSDIR}/requirements_${TYPE}.txt" \
         --destination "${FRAMEWORKDIR}"