[samaxbytez]

Fixes from code, simplify and security reviews of the initial commit.

Sync script

• Fails if an endpoint page has no OpenAPI block, or if two pages define the same path or component differently. Previously these were skipped or only warned.
• Normalises ?query path keys during the merge, so they go through the conflict check instead of a separate overwrite pass.
• Splits into a temp dir and swaps it in, so a failed split no longer deletes openapi/.
• --check now compares the split output file-by-file against openapi/ instead of bundling and comparing sorted JSON.
• Calls the local redocly binary instead of npx redocly (which can resolve to an unrelated npm package).
• 30s fetch timeout, a worker pool instead of fixed batches, and isDeepStrictEqual for comparisons.
• Rejects __proto__, constructor and prototype keys from docs YAML.

Spec and tooling

• The info block override moves from the sync script into a Redocly info-override decorator, so openapi/ is again an exact copy of the docs and only the release files carry the Nomba title, contact and license.
• npm scripts use the nomba API alias from redocly.yaml.
• Replaces preview (preview-docs no longer exists in Redocly CLI 2.x) with docs, which renders dist/index.html.

CI

• npm cache on setup-node.
• Release fails if the tag doesn't match package.json's version.

Docs

• CHANGELOG no longer claims saved-card charges are new; the old spec has them.

Verified locally: npm run lint, npm run bundle, npm run docs, npm run sync -- --check (exit 0 when clean, exit 1 after editing a file under openapi/).