Function parse_secret_reference 

pub fn parse_secret_reference(value: &str) -> Option<Result<SecretRef, String>>

Classify a configured secret string (DW-045):

• None — the value is a plain literal (does not start with ${), including values that merely start with $ and values that only CONTAIN ${...} mid-string (no partial expansion).
• Some(Ok(ref)) — a well-formed ${...} reference.
• Some(Err(message)) — the value is reference-shaped (starts with ${) but malformed, INCLUDING a reference that is never closed (${unclosed, ${file:/run/token) or does not span the whole value (${KEY}extra): reference-shaped garbage is a validation error, never a silently installed literal key. The message says why and is safe to surface in a validation issue (it names the reference text, never a value).