Your read is right, and fair point on the allowlist: editing network policies is part of serverless egress control, which is an Enterprise capability, so on Premium the propagation window is the path.

Your timing hypothesis matches how this works internally. Creating or updating an external location propagates quickly, but the workspace-level implicit registration that feeds the serverless storage allowlist converges on a slower cycle, documented at up to 24 hours. I'd say give it a try in sometime again.