Function validate_source 

pub fn validate_source(source: &Source) -> ValidationResult

A single backup Source is well-formed: exactly one of pvc, pvcSelector, or nfs is set (ADR §3.3 — modeled as sibling Options because the forms share sourcePath* keys, so it’s a webhook check, not an enum). When the source is nfs, its server/path are also validated.