A new SaaS subdomain is onboarded to a shared CDN and only one campus fails

DNS is correct, yet the shared edge sends the new hostname through a stale policy bundle with the wrong origin trust chain.