Your CNAME is correct and propagated, but the TXT verification record is at the wrong host. Because you added a www subdomain, the TXT record needs to be created at _railway-verify.www (zone-relative in your registrar's DNS panel), not bare _railway-verify on the apex. Move or recreate the TXT record at that corrected host and verification should complete shortly after propagation.

'The TXT record is already correctly set at _railway-verify.www.numinia.fr (not bare _railway-verify) — confirmed via my OVH DNS panel and via dnschecker.org, fully propagated. This is not the issue. Could a human please check the domain verification status directly?'

We just queried the live DNS and the TXT record with your verification token is resolving at _railway-verify on the apex zone, not at _railway-verify.www where it needs to be for this subdomain. Your OVH panel may show it under a name that looks correct, but the record is landing on the apex. In OVH, set the record name to _railway-verify.www (OVH appends the zone automatically). Once it propagates to the correct host, verification and certificate issuance will proceed on their own.