Reference resolver — resolves short references (namespace:id, bare aliases) into real filesystem paths or IDs, with containment checks and symlink traversal protection.
namespace:id