fix: scope Door A's ownership scan to its own filename prefix

The §3 ownership scan globbed every *.md file regardless of which door
wrote it, then unconditionally unlinked whatever _is_ingest_owned agreed
to. Because _is_ingest_owned reads through the line-oriented parser that
flattens nested blocks (pinned in
test_two_nested_block_mappings_sharing_a_key_collide_in_the_scalar_parser),
a Door B/C file whose nested content happened to share a key name with
the ownership markers (generated, ingest_manifest) could get promoted to
top level and spoof ownership -- silently deleting content this door
never wrote.

Scoping the glob to ingest_prefix closes this by construction: a Door
B/C file is never even a candidate for the scan, regardless of what its
frontmatter parses to. Traced from a coordination tip from
portfolio-optimiser-claude about the same flattening mechanism hitting
their `type` field.

tests/test_materialize.py

@@ -340,6 +340,37 @@ def test_replacement_leaves_another_manifests_stamped_file(file_setup: tuple[Pat
     assert (bundle / "ingest-orders.md").is_file()
 
 
+def test_a_door_c_import_survives_a_same_stem_materialize_run(
+    file_setup: tuple[Path, Path],
+) -> None:
+    # The §3 scan used to glob every `*.md` regardless of which door wrote it,
+    # then unconditionally unlink whatever `_is_ingest_owned` agreed to. The
+    # line-oriented parser has no indentation model (pinned in
+    # test_two_nested_block_mappings_sharing_a_key_collide_in_the_scalar_parser),
+    # so a nested block in an externally-imported concept that happens to
+    # share a key name with the ownership markers gets promoted to a
+    # top-level `generated`/`ingest_manifest` pair and can spoof ownership —
+    # deleting content this door never wrote and does not own.
+    manifest_path, bundle = file_setup
+    bundle.mkdir()
+    imported = bundle / "import-external.md"
+    imported.write_text(
+        "---\n"
+        "type: Concept\n"
+        "title: Imported Concept\n"
+        "provenance:\n"
+        "  generated: true\n"
+        "  ingest_manifest: manifest@deadbeef\n"
+        "---\n\nExternally imported body.\n",
+        encoding="utf-8",
+    )
+
+    materialize_bundle(manifest_path, bundle, INGESTED_AT)
+
+    assert imported.is_file()
+    assert (bundle / "ingest-orders.md").is_file()
+
+
 def test_second_manifest_does_not_delete_first_manifests_stamped_file(tmp_path: Path) -> None:
     # §10.2 per-manifest ownership: two manifests writing into ONE bundle each
     # own only the files whose stamp names them by stem. Running manifest B