Function validate_snapshot_replication 

pub fn validate_snapshot_replication(
    spec: &SnapshotReplicationSpec,
) -> Vec<ValidationError>

Validate a SnapshotReplication spec, accumulating all problems (issue #368): both repository refs are well-formed and not literally the same reference, the schedule cron/timezone/jitter parse, every identity matcher sets at least one component and every set component is a compilable glob, migrate.parallel is >= 1, a retention pruning keeps at least something, and (when a mover is set) it’s well-formed and does not claim inheritSecurityContextFrom. The “two different refs resolving to the same storage” rule needs both resolved backends, which this pure validator cannot fetch — the webhook resolves them and compares [backend_target_key]s.