My issue is that the second certificate is automatically used for test.com, but I’d like to keep staging’s certificate dedicated to staging so the staging URL is not shown on the certificate details of the root.
So in the case where multiple certs of the same type (e.g. Advanced SSL Certificates) exist and the hostname matches, the most recently deployed one will win:
Cloudflare deploys the most recent certificate in case two certificates of the same type and hostname exist.
So if you’re seeing your staging cert take priority for the apex - if you remove/re-order your other cert, it should take priority for you.