When I first ran --token I gave it my email address instead of my username.
This works enough to be confusing! Specifically, the tile source upload works (presumably the API is willing to accept an email instead of a username?), but then the geojson validation fails because "layers.my_layer_name.source does not belong to account 'myusername'.", because it had interpolated the given username into the name of the tile source in the recipe file.
Suggestion: Resolve the situation gracefully, either by somehow ascertaining the username from email, or simply by refusing to accept a username that contains a "@", or perhaps just detecting the mismatch and giving a more pointed error message?