A WAF blocks legitimate traffic only (alternate-proxy-chain-triggers-different-waf-signals)

The main site is correctly tuned, yet the same application breaks on a second hostname because the WAF sees different request attributes after another ingress path rewrites them.