The front door works.

Served from common-infra-lb-test-web through the shared global load balancer in common-infra-top-org-level.

Chain proved: DNS → global IP → forwarding rule → target proxy → managed certificate (SNI) → url map → backend bucket → object.