fix(graph): validate the whole max_concurrency template string

A string max_concurrency passed the load-time check whenever it merely
contained a {{...}} pair, so forms like "n={{k}}" or "{{ key }}" that
can never resolve at runtime were only caught after the map's inputs had
been computed. The check now requires the trimmed string to be exactly
one template reference, matching what interpolate_raw resolves as a pure
reference; padded forms like " {{budget}} " stay valid.

Also: the bash tool build-failure context names the source file instead
of the destination path, and the map-subgraph validator no longer
shadows its member id list with the resolved member nodes.

src/parsers/bash.rs

@@ -19,7 +19,7 @@ pub fn generate_bash_declarations(
 
     debug!("Building script at '{tool_file:?}'");
     let (build_script, declarations) = build_bash_tool(&src, file_name)
-        .with_context(|| format!("Failed to build script at '{tools_file_path:?}'"))?;
+        .with_context(|| format!("Failed to build script '{file_name}'"))?;
     function::write_file_atomic(tools_file_path, &build_script, Some(0o755))
         .with_context(|| format!("Failed to write built script to '{tools_file_path:?}'"))?;