fix(project): exempt cdn_channel consumers from released-source validation; review polish

- Extend ValidateLayout exemption so cdn_channel consumers skip root/include/
  derive/manifest requirements (they resolve entirely from Source.* at runtime).
- Add TestValidateLayoutAcceptsCDNChannelConsumerWithoutReleasedSourceFields.
- Fix inverted precedence comment in CDN-base resolution block (autogen.go:325).
- Add broken-YAML subtest to TestResolveCDNChannelHardFail.
- Add assumption comment to autogenConsumerManagedLockKeyMatcher re folder_name+preserve.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/topdata/autogen.go

@@ -189,6 +189,10 @@ func autogenConsumerManagedLockKeyMatcher(consumer project.AutogenConsumerConfig
 		prefix := dataset + ":"
 		// Build the group set from the resolved policy so consumers that omit
 		// AccessoryVisualeffects.Groups still match the four default group names.
+		// NOTE: this matcher assumes the default folder_name+preserve group
+		// representation. Keys produced under case:lower or
+		// group_token_source:prefix would not match and would escape pruning;
+		// no production config uses those combinations.
 		policy := resolveAccessoryVisualeffectsPolicy(consumer, nil)
 		groups := make(map[string]struct{}, len(policy.Groups))
 		for group := range policy.Groups {
@@ -322,7 +326,7 @@ func resolveCDNChannelManifest(p *project.Project, consumer project.AutogenConsu
 		channel = deriveAssetChannel(p.Root)
 	}
 
-	// 3. CDN base: env override, then config literal, then baked default.
+	// 3. CDN base: baked default, then env override, then config literal (most specific wins).
 	cdnBase := defaultBunnyCDNBase
 	if envName := strings.TrimSpace(src.CDNBaseEnv); envName != "" {
 		if v := strings.TrimSpace(os.Getenv(envName)); v != "" {

internal/topdata/autogen_cdn_channel_test.go

@@ -159,6 +159,18 @@ func TestResolveCDNChannelHardFail(t *testing.T) {
 			t.Fatalf("want HARD fail, got %v", err)
 		}
 	})
+
+	t.Run("malformed vfxs.yml: syntactically broken YAML", func(t *testing.T) {
+		srv := cdnServer(t, map[string]string{
+			"/releases/haks/channels.json": `{"current":"v1"}`,
+			"/releases/haks/v1/vfxs.yml":   "assets:\n  - path: [unterminated",
+		})
+		t.Setenv("BUNNY_CDN_BASE", srv.URL)
+		_, err := resolveCDNChannelManifest(testProject(root), c, c.Source, nil)
+		if err == nil || errorIsUnavailable(err) {
+			t.Fatalf("want HARD fail on broken YAML, got %v", err)
+		}
+	})
 }
 
 func TestResolveCDNChannelOfflineOverride(t *testing.T) {