Change permalinks for posts & for custom post types

with_front=false is the key, but WordPress also seems to like to hard-cache the settings you originally register a CPT with. Try unregister_post_type() above the CPT registration so it’s completely removed and immediately added again from scratch with the with_front setting.