The greatest benefit I derive from StackExchange is that asking the question forces me to state the problem in detail.
In this case, I through in the parenthetical “(Cloudfront)” solely for completeness, but then I thought, “Hey...”
Yes, turns out, when I set up the Cloudfront distribution for
www (weeks ago) I specified the “alternative CNAME”, as “*.mydomain.com” of course.
The two CNAMEs resolved to two different Cloudfront distributions, but then AWS read the HOST header in the HTTPS request, to choose which distribution to use, so it was sending all traffic to the
www one, because it had the wildcard.
Correcting the two “alternative CNAME” settings on the distributions, to "www" and "d-test" respectively, fixed the problem.
(I have added the amazon-cloudfront tag to the question to help anyone with the exact same problem to find it, but presumably other CDNs work the same way.)