The standard deployment of CGNAT means the customer router gets a 100.64 address on the side facing the ISP, then NATs it with something like 192.168. So the cgnat range is not visible to the end user machine and there is no conflict if we use it again.

We have unfortunately discovered phone carriers who hang out cgnat addresses directly to phones, so we will need to do something else there.

Which is perfectly valid usage. CGNAT addresses are supposed to be used on ISP-customer link. Whether there is customer router or just customer end computer on that link is customer decision.

The phone carrier situation is similar - CGNAT address is assigned to customer device on radio interface, whether that device is phone or LTE-based router is customer decision.