[Custom domain] CNAMEAlreadyExists — orphaned internal CloudFront distribution holding demo.coralehr.com

**Summary:** The alternate domain name (CNAME) `demo.coralehr.com` is stuck on an orphaned, Amplify-managed CloudFront distribution in an AWS-internal account. It is not attached to any distribution or Amplify app in our accounts, so we cannot release it ourselves. Please disassociate/delete this alias from the internal distribution so we can re-attach `demo.coralehr.com` to our Amplify app.

### Our account / app
- AWS Account: `689186650710`
- Region: `us-east-1`
- Amplify App ID: `d1cait0f5c2lkk` (`coral-ehr-frontend-demo-manual`)
- Domain association: `coralehr.com`, subdomain `demo` (branch `demo`)
- Domain association status: `FAILED`
- statusReason (verbatim): `One or more of the CNAMEs you provided are already associated with a different resource.`

### The conflicting resource (from `aws cloudfront list-conflicting-aliases`)
```
Alias: demo.coralehr.com
DistributionId: ******ATL97HY
AccountId: ******359175 <-- not one of our accounts; AWS-internal Amplify account
```

### What we have already verified / ruled out (so this is not a config issue on our side)
1. The alias is **not** on any CloudFront distribution in our accounts `689186650710` or `484907521900` (full `list-distributions` sweep — none carries `demo.coralehr.com`).
2. **No** current Amplify app references the `demo` subdomain — checked every app in `us-east-1` and `us-east-2`. Only this app's (now FAILED) association uses it.
3. Route 53 (authoritative zone `Z0694806V0OHKW9XYOWR`) is clean and already routes to our target distribution: `demo.coralehr.com` CNAME → `d3t8nspnec5xq4.cloudfront.net` (our distribution `ET0BYIY3DLALI`), plus the ownership/validation records (`_demo.coralehr.com` TXT → target domain, `_a5d57da….demo.coralehr.com` cert validation).
4. We attempted the self-service cross-account move: `aws cloudfront associate-alias --target-distribution-id --alias demo.coralehr.com`
- Added the ownership-verification TXT record (`_demo.coralehr.com`) — verification passed.
- The move then failed with: **`Alias move is not allowed since the source distribution is enabled.`**
- We cannot disable the source distribution because it is in account `******359175`, which we do not control.
5. The orphaned distribution is demonstrably **still live and still holding the alias**: with `demo.coralehr.com` pointed at our own (resolvable) distribution domain, requests for the hostname still return **HTTP 200 served by the conflicting distribution** via CloudFront Host-header routing. In other words `******ATL97HY` continues to answer for `demo.coralehr.com` even though it exists in none of our accounts — which is exactly why we cannot release it ourselves.

### Request
Please remove / disassociate the alternate domain name `demo.coralehr.com` from the orphaned internal CloudFront distribution `******ATL97HY` (account `******359175`) so we can associate it with Amplify app `d1cait0f5c2lkk`. This appears to be the known case where deleting an Amplify domain association orphaned the internal CloudFront distribution without releasing its CNAME alias.

### Once released we will finish on our side in one step
(cert + target distribution + ownership TXT + DNS are all already staged)
- ACM cert (ISSUED): `arn:aws:acm:us-east-1:689186650710:certificate/68acadeb-873e-466a-ad68-7c9e10999236`
- Target CloudFront distribution: `ET0BYIY3DLALI` (`d3t8nspnec5xq4.cloudfront.net`)
- DNS already routes there: `demo.coralehr.com` CNAME → `d3t8nspnec5xq4.cloudfront.net`
- Finish command: `aws cloudfront associate-alias --target-distribution-id ET0BYIY3DLALI --alias demo.coralehr.com`

Thank you.

Start by reviewing the reported `aws cloudfront list-conflicting-aliases` output, the orphaned distribution `******ATL97HY`, and the failed `associate-alias` attempt. Done means AWS removes `demo.coralehr.com` from the internal distribution so the requester can successfully associate it with distribution `ET0BYIY3DLALI`.

Written by the indexing model from the issue text.