release: docs 0.2.2

[m1ngsama]

What changed

• add safe path and repository-coordinate validation
• validate GitHub response shapes and exclude symlinks and submodules
• isolate cached snapshots from caller mutation
• deduplicate concurrent requests and make clear() safe around in-flight work
• keep timeouts active through response consumption and restrict stale fallback to transient failures
• prepare @nbtca/docs 0.2.2

Why

The client could accept repository-path traversal, expose unsupported entry types, let callers mutate cached arrays, and hide permanent HTTP failures behind stale data.

Impact

Directory, tree, and file reads now have predictable cache, concurrency, timeout, and error behavior without changing the public client methods.

Validation

• 2 test files and 55 tests passed
• TypeScript build passed
• local Prompt integration passed
• npm audit --omit=dev reported 0 vulnerabilities
• npm pack and npm publish --dry-run --access public passed