fix: scope Door A's ownership scan to its own filename prefix

The §3 ownership scan globbed every *.md file regardless of which door
wrote it, then unconditionally unlinked whatever _is_ingest_owned agreed
to. Because _is_ingest_owned reads through the line-oriented parser that
flattens nested blocks (pinned in
test_two_nested_block_mappings_sharing_a_key_collide_in_the_scalar_parser),
a Door B/C file whose nested content happened to share a key name with
the ownership markers (generated, ingest_manifest) could get promoted to
top level and spoof ownership -- silently deleting content this door
never wrote.

Scoping the glob to ingest_prefix closes this by construction: a Door
B/C file is never even a candidate for the scan, regardless of what its
frontmatter parses to. Traced from a coordination tip from
portfolio-optimiser-claude about the same flattening mechanism hitting
their `type` field.

src/llm_ingestion_okf/materialize.py

@@ -457,10 +457,20 @@ def materialize_bundle(
     staged_names = {name for name, _ in staged}
 
     # §3 ownership scan (sorted for determinism): only files carrying the
-    # ingest stamp are ours to replace.
+    # ingest stamp are ours to replace. Globs by THIS door's prefix, not just
+    # the shared suffix: `_is_ingest_owned` reads through the line-oriented
+    # parser that flattens nested blocks (pinned in
+    # test_two_nested_block_mappings_sharing_a_key_collide_in_the_scalar_parser),
+    # so a Door B/C file whose nested content happens to share a key name
+    # with the ownership markers could otherwise spoof ownership here and get
+    # unlinked below — content this door never wrote. Scoping the glob to
+    # `ingest_prefix` closes that by construction: a Door B/C file is never
+    # even a candidate, regardless of what its frontmatter parses to.
     owned = {
         path.name
-        for path in sorted(bundle.glob(f"*{profile.paths.concept_suffix}"))
+        for path in sorted(
+            bundle.glob(f"{profile.paths.ingest_prefix}*{profile.paths.concept_suffix}")
+        )
         if path.name != profile.index.name
         and _is_ingest_owned(path, manifest_file.stem, profile=profile)
     }