bug(markup): exponential backtracking in reference-name validation #447

Security review finding (medium, CWE-1333).

packages/markup/src/syntax.ts validates dotted reference names with ^[A-Za-z_][A-Za-z0-9_.:-]*(?:\.[A-Za-z_][A-Za-z0-9_.:-]*)*$. . appears both inside the segment character class and as the separator, so on a malformed dotted name the regex engine tries exponentially many partitions — ~330 ms at 25 trailing dots, doubling per dot; ~40 dots is effectively a parse-thread hang. Reachable from any authored .svml file.

The same ambiguity means the pattern also accepts a., a..b and x.y., which the strict grammar rejects.

Proposed fix: strict ident(.ident)* — . becomes separator-only so matching is linear.

Fix: #439