Code signing and entitlements are integrated into the binary.

(Restricted entitlements require a provisioning profile which requires a bundle, but restricted entitlements are pretty rare)