fix(deps): protect owned destination files

[jbeda]

Problem

deps import guarded its destination using the broad provenance-prefix classifier. A locally owned model with an unknown reserved-prefix comment such as # modelith-note: ... was therefore treated as a malformed vendored copy and could be overwritten.

Fix

Replacement now requires the existing provenance header to identify an origin and path for the same source. A malformed header that still identifies that source remains repairable. An unidentified header blocks import and directs the user to choose another directory or deliberately move/delete the existing file.

Verification

• Regression test proves the original file remains byte-identical after the refused import.
• task check passes.

Found while auditing the merged vendoring slice; the behavior existed in slice 2 rather than being introduced by the later refresh work.