Well, that’s pretty convincing: those build-times pretty much nail it, assuming the code they correspond to wasn’t particularly atypical.
I’ve fixed the safelist locally in the mean time, so I’ll now try deploying this shiny new Hugo-only build process to Cloudflare Pages, using the same build command and environment setup you recommend for Netifly.