CloudFront VPC Origin returns 504? Your origin's security group is lying to you

I built a clean private-ingress edge on AWS: CloudFront out front for TLS, WAF, and Shield; a private...