Custom domain TLS handshake hangs (edge cert stuck) — DNS is correct, .vercel.app works fine - Help

Custom domain playendzone.com (and www.playendzone.com) TLS handshake hangs/times out on Vercel's edge, while .vercel.app on the same project works fine.

DNS is correctly configured (Cloudflare, CNAME to the assigned .vercel-dns-.com target), confirmed via dig.
Domain shows "Valid Configuration" in the dashboard.
Connecting directly to the resolved edge IP with a different SNI hostname succeeds; only this domain's SNI hangs — isolates it to the edge's cert lookup for this specific hostname, not DNS or general connectivity.
Already tried Refresh and a full Remove+Re-add of the domain — no change.

Project: end-zone (team red-zone3)