I knew you can use `osascript` but this still does not tell me if it works with unsigned apps or not. For all we know `osascript` is signed which means it respects the rules.
You can call `osascript` from inside your app, or you can export an AppleScript script as an app. So yes, it works on unsigned apps. It has the same Gatekeeper caveats as any other unsigned app, but there’s nothing about notifications that’s especially locked.