fix(core): enforce external ref path casing

[popsiclelmlm]

What/Why/How?

Summary

Fixes #1326 by making local external ref resolution reject file paths whose casing does not match the filesystem entry.

Reproduction

On case-insensitive filesystems, a ref such as ./externalInfo.yaml can resolve successfully even when the real file is named externalinfo.yaml. That means rules such as no-unresolved-refs may accept refs that fail on case-sensitive environments.

The added regression test simulates this by making the filesystem report externalinfo.yaml while the resolver tries to load externalInfo.yaml.

Root cause

BaseResolver.loadExternalRef resolved local paths with path.resolve, then called lstatSync and readFile. On a case-insensitive filesystem those calls still succeed for a mismatched filename, so the resolver never observed the casing mismatch.

Changes

• Add a local path casing check before reading non-URL external refs.
• Keep URL refs unchanged.
• Add a regression test for mismatched file path casing.
• Add a patch changeset for @redocly/openapi-core and @redocly/cli.

Reference

Fixes #1326

Testing

• git diff --check
• VITEST_SUITE=unit ./node_modules/.bin/vitest run packages/core/src/__tests__/resolve.test.ts --coverage.enabled=false
• npm run compile
• npm run typecheck
• npm run lint (0 errors; existing warnings remain)
• npm run format:check

Screenshots (optional)

N/A

Check yourself

• This PR follows the contributing guide
• All new/updated code is covered by tests
• Core code changed? - Tested with other Redocly products (internal contributions only)
• New package installed? - Tested in different environments (browser/node)
• Documentation update has been considered

Security

• The security impact of the change has been considered
• Code follows company security practices and guidelines

[changeset-bot]

🦋 Changeset detected

Latest commit: c407edb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/cli	Patch
@redocly/openapi-core	Patch
@redocly/respect-core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR