fix(pkg): surface real notarization failures, guard against stale nspkg.pth in venv

macOS build (build-functions.sh): _notarize_pkg only printed
"Notarization failed." on rejection, giving no indication why. Print
the actual REQUEST_STATUS and fetch the full notary log via
`notarytool log` so future failures are actually diagnosable from the
Jenkins console instead of just "status: Invalid".

Linux build (build-functions.sh): _create_python_virtualenv creates
venvs with --system-site-packages, which pulls in the entire system
site-packages dir - including any stale, improperly-uninstalled
package's namespace-package .pth hook. That legacy pip/setuptools
mechanism runs at interpreter startup, before core stdlib is
guaranteed to resolve; a leftover sphinxcontrib-jsmath nspkg.pth on
the el-10 build node corrupted sys.path early enough to break pip's
own subprocess bootstrap, failing the whole build with a misleading
"No module named 'importlib'"/"'traceback'" error
(pgadmin4-rpm-build #176). Remove that exact known-broken file before
creating the venv - not every *-nspkg.pth, since this touches the
*system* Python install on a build node shared by other jobs, and any
other such file could still be load-bearing for something unrelated.
--system-site-packages itself is left untouched - it's required so
venvs can see OS-provided packages not available as clean pip wheels
on every target platform.

pkg/linux/build-functions.sh

@@ -68,6 +68,28 @@ _create_python_virtualenv() {
     mkdir -p "usr/${APP_NAME}"
     cd "usr/${APP_NAME}" || exit
 
+    # We create the venv with --system-site-packages below, so a stale,
+    # improperly-uninstalled package's namespace-package .pth hook in the
+    # *system* site-packages gets pulled in too. That old pip/setuptools
+    # namespace mechanism runs arbitrary code at interpreter startup,
+    # before core stdlib modules are guaranteed to resolve. A leftover
+    # sphinxcontrib-jsmath nspkg.pth on the el-10 build node corrupted
+    # sys.path early enough to break pip's own subprocess bootstrap,
+    # failing the whole build with a misleading "No module named
+    # 'importlib'"/"'traceback'" error (pgadmin4-rpm-build #176).
+    #
+    # Only remove that exact known-broken file, not every *-nspkg.pth -
+    # this modifies the *system* Python install on a build node shared
+    # by other jobs, and any other such file could still be load-bearing
+    # for something unrelated to this build.
+    "${SYSTEM_PYTHON_PATH}" -c \
+        "import site; print('\n'.join(site.getsitepackages()))" | \
+    while IFS= read -r SITE_DIR; do
+        find "${SITE_DIR}" -maxdepth 1 \
+            -name 'sphinxcontrib_jsmath-1.0.1-py3.7-nspkg.pth' \
+            -print -delete 2>/dev/null
+    done || true
+
     # Create the blank venv
     "${SYSTEM_PYTHON_PATH}" -m venv --system-site-packages venv
     # shellcheck disable=SC1091

pkg/mac/build-functions.sh

@@ -690,7 +690,12 @@ _notarize_pkg() {
         awk -F ': ' '/status:/ { print $2; }')
 
     if [[ "${REQUEST_STATUS}" != "Accepted" ]]; then
-        echo "Notarization failed."
+        echo "Notarization failed with status: ${REQUEST_STATUS}"
+        echo "Fetching notary log for details..."
+        xcrun notarytool log "${SUBMISSION_ID}" \
+            --team-id "${DEVELOPER_TEAM_ID}" \
+            --apple-id "${DEVELOPER_USER}" \
+            --password "${DEVELOPER_ASP}"
         exit 1
     fi