Should the manifest file of a hosted Firefox OS app live on the same domain? I'd like to put it on a CDN together with the rest of the static files.
Yes it should be served from the same origin. That is part of the security model of hosted apps and it is there to prevent abuse of your app. Take a look at manifest page on MDN:
... the paths must be served from the same origin as the app