Why is the OOTB SAML authentication not enough? What do you want to achieve?

How do you deploy this file? Via fullstack pipeline or frontend pipeline?In case of the fullstack pipeline: Not a problem, as new instances will be started with an empty dispatcher cache. So you don't need to invalidate them.Frontend pipeline: Good question, I am not an expert in that ... would need...

Can you please point me to the documentation which says that SAML 2.0 authentication on publish is not available on AEM CS?(I know a number of cases, where this is working.)

Where did you configure the statfilelevel? It's only respected in the farm which is used by the invalidation requests.

when you replicate that page (and therefor trigger an invalidation), at which directory is the closest .stat file?

can you post a minimal HTL scriptlet with hardcoded values, which demonstrates this behavior?

when you write "should get cached", do you mean cached at the dispatcher level? The dispatcher caches files with its full path (taken from the URL) below the configured docroot. That means:https://www.hostname.internal/page.html => $DOCROOT/page.htmlhttps://www.hostname.internal/path/to/page.html =>...

IIRC /conf does not know about runmodes. 

It seems that CRXDE Lite should be a more resilient in this area... This request does not actually perform the replication, but is rather reading the replication status (I don't the know frontend code of CRXDE Lite good enough to say if this always happens after the replication request has been done...

Yes, it will be removed soon (loglevel degraded to DEBUG)