A test pins that ref links never smuggle a path: `pathCrumbs` and `refMenu` encode refs and escape names #6750

src/web/pages/refs.ts promises that a ref leaving it in a URL is percent-encoded, so feature/a stays one segment, and that every name is escaped. No test calls pathCrumbs or refMenu.

Done when a new test file proves:

• [ ] pathCrumbs(base, name, "feature/a", "src/x.ts", true) links each walked directory under /tree/feature%2Fa/… and the leaf is text, not a link.
• [ ] a ref or path segment containing <, ", ? or # appears escaped in the HTML and encoded in every href.
• [ ] an empty path gives just the repository crumb.
• [ ] refMenu built from a RefSet with branches and tags encodes each href the same way and marks the current ref.

Test only; a bug it finds is fixed in the same pull.