With the AP-typed match, the station-mode netdev is unmanaged until hostapd flips it, so any wpa_supplicant/iwd/NetworkManager in the importing config would grab the radio first and keep resetting it to managed mode under hostapd. Fail at eval instead of at runtime.