The Only Missing Piece Was the DNS Record
www.csv-helper.com returned NXDOMAIN for years. The certificate already covered it and CloudFront already accepted it — every part of the fix was done except the DNS record. Then I swept the account and found four more exactly like it.