validate_headref: tighten ref-matching to just branches