Reference resolver — maps short references (namespace:id and bare aliases) to real filesystem paths or identifiers, with canonicalization, host-root containment checks, and symlink-traversal protection.
namespace:id