Response below for formatting purposes.

Thanks for the test ideas! I downloaded the .dmg using curl without triggering quarantine, and the application runs fine! So what does this mean? This is a Gatekeeper issue for sure, and not really a code signing issue? How do solve this for other users downloading my .dmg using a browser where it's flagged for quarantine?

I think your posts ultimately led me to realize where I went wrong. There's a procedural difference between local signing that Xcode does when building and actual notarization process with Apple. My application was signed, but that copy was not notarized, that's why Gatekeeper won't let me run it when it's quarantined, but let me run outside of quarantine.