Looks like the problem may have been that I hadn’t cliked to publish a deployment, so only “previews” existed, and this maybe was holding up the certificate provisioning.
This would have been good to have in the troubleshooting guide rather than having to guess.