pub fn validate_ref_token(path: &str, value: &str) -> Result<(), String>
Reject ref spellings that can escape the graph namespace or become ambiguous when rendered, logged, or used as storage keys.