Release security: make it impossible to clobber builddirs which have the "release prefix"

This would be more generic if it was IGNORE_PREFIXES (or maybe IGNORE_SUBSTRINGS), but it's not a blocker.