feat(C3.1): #foreign refs are validated — must name a #library or a named #import c unit

validateForeignRefs walks the merged tree (libraries + named c units,
nested namespaces included) and diagnoses any #foreign whose ref names
neither — a typo'd ref previously compiled and resolved silently
through whatever image carried the symbol. Decls synthesized from
#include headers carry no ref and are exempt. Flips the C0.2b pin;
zero collateral across the 608 other examples.

examples/1620-cimport-foreign-ref-unvalidated.sx

@@ -1,9 +1,8 @@
-// Pins the C3 gap (PLAN-C C0.2b): the `#foreign` library/unit ref is
-// DECORATIVE today — `nosuchunit` names nothing anywhere, yet this
-// compiles and the symbol resolves globally (the unit's objects are in
-// the program; the ref is never consulted). After C3 this is a
-// compile-time diagnostic: a #foreign ref must name a #library or a
-// named `#import c` unit.
+// A `#foreign` ref must name something real (PLAN-C C3.1): `nosuchunit`
+// names neither a #library constant nor a named `#import c` unit, so
+// this is a compile-time diagnostic — a typo'd ref previously compiled
+// and resolved silently through whatever image carried the symbol.
+// Regression (PLAN-C C0.2b xfail, flipped by C3.1).
 #import "modules/std.sx";
 
 refs :: #import c {

examples/expected/1620-cimport-foreign-ref-unvalidated.exit

@@ -1 +1 @@
-0
+1

examples/expected/1620-cimport-foreign-ref-unvalidated.stderr

@@ -1 +1,5 @@
-
+error: #foreign library 'nosuchunit' is not declared; expected a #library constant or a named '#import c' unit
+  --> examples/1620-cimport-foreign-ref-unvalidated.sx:12:1
+   |
+12 | ref_answer :: () -> i32 #foreign nosuchunit "ref_answer";
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

examples/expected/1620-cimport-foreign-ref-unvalidated.stdout

@@ -1 +0,0 @@
-ref = 7