re-hardlink after signing

Previously we would hardlink noarch packages into place and then sign the
packages twice, once from each arch dir. However, when we sign the initial
package, its inode actually changes, and the other one stays the same. So when
we sign the "second" package, we're really signing a different file, and in
doing so generating a different md5 sum than the first one. This commit updates
the workflow to only hardlink packages into place when we're shipping, after
we've signed. This way the packages are identical.

Signed-off-by: Moses Mendoza <moses@puppetlabs.com>