test(extract): allow reserveParkedName in the raw-reader guard (creates in needs-review/, reads nothing) (#205)

The previous commit was pushed with this guard red: the gate was run with ';'
instead of '&&'. Allowlisting is the guard's own sanctioned mechanism and is
called out for review.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

ingestion/internal/extract/callsites_test.go

@@ -89,6 +89,9 @@ func TestNoPackageReferencesExtractTextOutsideExtract(t *testing.T) {
 // on a path that is not a raw/ read.
 var osOpenAllowed = map[string]bool{
 	"internal/watcher/watcher.go:appendWatcherLog": true, // ingest log append, not a raw/ read
+	// Claims a free name in raw/needs-review/ with O_EXCL so a parked note is
+	// never overwritten (#205). It creates a file; it reads nothing from raw/.
+	"internal/watcher/watcher.go:reserveParkedName": true,
 	// Text reads by path; outside this package only TextIn's temp copy reaches
 	// it (TestNoPackageReferencesExtractTextOutsideExtract enforces that).
 	"internal/extract/extract.go:Text": true,