http-push.c::lock_remote(): validate all remote refs.