The naming rule: a derived scope and a source scope must not share their first dot-segment, because a prefix.* grant would then cover both and leak across the lineage edge. Mirrors the Personal Server's check (LINEAGE_SCOPE_UNDER_SOURCE_PREFIX).
prefix.*
LINEAGE_SCOPE_UNDER_SOURCE_PREFIX
The naming rule: a derived scope and a source scope must not share their first dot-segment, because a
prefix.*grant would then cover both and leak across the lineage edge. Mirrors the Personal Server's check (LINEAGE_SCOPE_UNDER_SOURCE_PREFIX).