Apex domain on a JAMstack CDN: ALIAS/ANAME record or subdomain redirect with CNAME?

I'm deploying a static JAMstack site behind a CDN and need to decide how to handle the root domain (example.com) alongside www.example.com. The CDN provides edge hostnames, and I understand a CNAME works fine for the subdomain but is not valid at the zone apex, so the apex typically needs an ALIAS/ANAME record or a flattened CNAME, depending on the DNS provider.

The constraint is TLS certificate behavior. The CDN issues managed certificates automatically, but issuance and renewal depend on the domain resolving correctly to the edge. My concern is that an ALIAS/ANAME setup at the apex may resolve differently across resolvers or propagate unevenly, causing intermittent certificate validation failures or the edge serving a mismatched certificate while records settle. The alternative is keeping the site on www with a plain CNAME and redirecting the apex, which avoids ALIAS support issues entirely but adds a redirect hop and depends on the provider's redirect service having its own valid certificate for the apex.

Assuming a current major CDN and a mainstream DNS provider:

• For the apex, is an ALIAS/ANAME record reliable enough for managed certificate issuance and renewal, or does it introduce validation-timing risk compared with a CNAME-only setup?
• Does redirecting the apex to www meaningfully change TLS behavior for clients hitting the root domain first?
• How can I verify, before cutover, that the CDN will present the correct certificate on both names?