feat: refuse a citation no repository can hold

kenji-nx cited tmp/es-de/ANDROID.md:470-474, a path from the machine of
whoever profiled it. No revision of any declared repository holds it, so
profile_sync could only report it missing, every pass, forever, and no
amount of reading would ever settle it.

validate_schemas now refuses a scratch directory, an absolute path, a
Windows drive path and one climbing out of the tree, and names the
offending citation rather than the scalar that carries it. Offline, so it
runs on every push and every pull request rather than waiting for a
network pass.

The ES-DE citation reads as external now, which is what it always was.
kenji-nx is at 37 refs, all anchored: the three changed blocks were var
giving way to explicit types.

scripts/validate_schemas.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import re
 import sys
 import zipfile
 from pathlib import Path, PurePosixPath
@@ -55,6 +56,7 @@ def _validate_yaml_directory(
             out.append(f"{path.relative_to(ROOT)}: {exc}")
             continue
         out.extend(_errors(validator, data, str(path.relative_to(ROOT))))
+        out.extend(_unreachable_citations(path, data))
     return out
 
 
@@ -132,6 +134,37 @@ def _scan_pack_manifests(dist: Path) -> list[str]:
     return out
 
 
+_UNREACHABLE_REF = re.compile(
+    r"(?:^|[\s,;(])(?:tmp/|/|[A-Za-z]:[\\/]|\.{1,2}/)[\w.\\/+-]*[\w+-]:\d+(?:-\d+)?"
+)
+
+
+def _unreachable_citations(path: Path, document: object) -> list[str]:
+    """Refs naming a place no repository can hold.
+
+    A citation is read against a revision of a declared repository, so a
+    scratch directory, an absolute path or one climbing out of the tree can
+    never resolve and never will. kenji-nx carried tmp/es-de/ANDROID.md:470,
+    a path from whoever profiled it, which profile_sync could only report
+    missing forever.
+    """
+    out: list[str] = []
+    stack: list[object] = [document]
+    while stack:
+        node = stack.pop()
+        if isinstance(node, dict):
+            stack.extend(node.values())
+        elif isinstance(node, list):
+            stack.extend(node)
+        elif isinstance(node, str):
+            for match in _UNREACHABLE_REF.finditer(node):
+                out.append(
+                    f"{path.relative_to(ROOT)}: citation names a path outside "
+                    f"any repository: {match.group().strip(' ,;(')}"
+                )
+    return out
+
+
 def _semantic_envelope_checks(path: Path, document: dict) -> list[str]:
     if document.get("count") != len(document.get("items", [])):
         return [f"{path.relative_to(ROOT)}: count does not equal len(items)"]