Solved it!
My assets.example.com CloudFront distribution needed a robots.txt file after all. After adding one following these instructionsthese instructions, googlebot is able to fetch & render my static assets successfully.
It no longer reports them as Temporarily unreachable, and instead shows Complete.
