fix(project): exempt cdn_channel consumers from released-source validation; review polish

- Extend ValidateLayout exemption so cdn_channel consumers skip root/include/
  derive/manifest requirements (they resolve entirely from Source.* at runtime).
- Add TestValidateLayoutAcceptsCDNChannelConsumerWithoutReleasedSourceFields.
- Fix inverted precedence comment in CDN-base resolution block (autogen.go:325).
- Add broken-YAML subtest to TestResolveCDNChannelHardFail.
- Add assumption comment to autogenConsumerManagedLockKeyMatcher re folder_name+preserve.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/project/project.go

@@ -1682,10 +1682,12 @@ func validateAutogenConfig(cfg AutogenConfig) []error {
 		if strings.TrimSpace(consumer.Mode) == "accessory_visualeffects" && accessoryVisualeffectsConfigConfigured(consumer.AccessoryVisualeffects) {
 			failures = append(failures, validateAccessoryVisualeffectsConfig(fieldPrefix+".accessory_visualeffects", consumer.AccessoryVisualeffects)...)
 		}
-		// A manifest_file consumer reads a pre-resolved local manifest, so the
-		// released-source fields (root/include/derive/manifest) are never read
+		// A manifest_file consumer reads a pre-resolved local manifest, and a
+		// cdn_channel consumer resolves entirely from Source.* at runtime, so
+		// neither reads the released-source fields (root/include/derive/manifest)
 		// at build time — don't require them. See resolveAutogenConsumerManifest.
-		if strings.TrimSpace(consumer.ManifestFile) == "" {
+		if strings.TrimSpace(consumer.ManifestFile) == "" &&
+			strings.TrimSpace(consumer.Source.Kind) != "cdn_channel" {
 			if strings.TrimSpace(consumer.Root) == "" {
 				failures = append(failures, fmt.Errorf("%s.root is required", fieldPrefix))
 			}