Every key the engine names is relative to the store root, and the provider puts it under
_strata/<site-id>/ so a bucket or a container can hold two sites and neither sees the other in a
listing. The prefix goes on the way out and comes off the way back, in one place, because a
provider that adds it in put() and forgets it in list() reports keys nothing can read.
A key arrives from a manifest and a manifest can be tampered with, so .., . and empty segments
are refused by name rather than normalised away.