pub fn validate_config_import(input: &str) -> Result<()>
Reject redacted placeholders before a full replacement can overwrite live secrets.