I was thinking of a string of Page Rules, but after ignoring root, then ignoring a subfolder, it will go into a redirect loop as it Matches /xyz/filename.php and then rewrites it as /xyz/filename.php/xyz/filename.php, which isn’t root or a subfolder.
Well mod_rewrite has the ‘-f’ and ‘-d’ options which can let you differentiate between files and folders so you could almost certainly do what you want using .htaccess or equiv on Apache.
If you want to use Page Rules you’d need to see if you can make the selection in rule (3) a bit more specific… ie. do those pages have an extension (rare these days, I know). You could do something like example.com/*.html → htttps://example.com/xya/$1.html, for example. You need to somehow get that selection more specific than just a string as Cloudflare has no idea if that string is accessing a folder or file, only your webserver would know that.