Move signed pkg to outputs/ before notarization

Fixes regression where a signed-but-unnotarized .pkg was built into
the staging dir and then deleted by cleanup() without ever reaching
outputs/. The pre-refactor script moved the .pkg unconditionally
after munkipkg succeeded; the refactor lost that mv when it was
consolidated into notarize_and_staple().

build_python_framework_pkgs.zsh

@@ -197,6 +197,8 @@ build_pkg() {
 JSON
 
     "${MP_BINDIR}/munki-pkg-${MP_SHA}/munkipkg" "$TOOLSDIR/$TYPE"
+    local pkg_built="$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$AUTOMATED_PYTHON_BUILD.pkg"
+    /bin/mv "$pkg_built" "$OUTPUTSDIR"
 }
 
 notarize_and_staple() {
@@ -208,7 +210,7 @@ notarize_and_staple() {
     xcode_dev="$(/usr/bin/xcode-select -p)"
     xcode_notary="$xcode_dev/usr/bin/notarytool"
     xcode_stapler="$xcode_dev/usr/bin/stapler"
-    pkg="$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$AUTOMATED_PYTHON_BUILD.pkg"
+    pkg="$OUTPUTSDIR/python_${TYPE}_signed-$AUTOMATED_PYTHON_BUILD.pkg"
 
     "$xcode_notary" store-credentials \
         --apple-id "opensource@macadmins.io" \
@@ -217,7 +219,6 @@ notarize_and_staple() {
         macadminpython
     "$xcode_notary" submit "$pkg" --keychain-profile macadminpython --wait
     "$xcode_stapler" staple "$pkg"
-    /bin/mv "$pkg" "$OUTPUTSDIR"
 }
 
 zip_framework() {