fix(deps): replace unmaintained YAML dependency graph

[reynholm]

Summary

Remove serde_yaml / unsafe-libyaml from both shipping Rust dependency graphs and remove only the RUSTSEC-2024-0449 exception. Direct consumers use YAML Organization's yaml_serde 0.10.7 / libyaml-rs 0.3; the Kubernetes path uses kube ~4.0 and OpenAPI 0.28. Preserve existing YAML semantics and Kubernetes context/authentication, the 295-second read timeout, and disabled automatic retries.

Regressions exercise persona/skill frontmatter, workflow parsing and round trips, Desktop migration of unknown/tagged/numeric YAML values, Goose configuration, and Kubernetes kubeconfig/exec authentication. See docs/fork/YAML_COMPATIBILITY.md.

Fixes #19.

Conflict resolution

Merge current main (9b76dbeb45b9f75de79f42fbb5ce2828e24e0479) into the feature branch. The only conflicts were parallel additions to scripts/fork/patches.json and its generated FORK_PATCHES.md. Preserve the registry entries from both sides and regenerate the Markdown. Include main's public-text rules and sanitized maintenance examples unchanged. Runtime sources, manifests, both lockfiles, test runners, and advisory policy are byte-identical to the previously reviewed feature tip df656115048967e1c539be6be8974f00db7b345c.

Validation

Fresh checks of the resolved merge tree on macOS Apple Silicon:

• Complete four affected Rust packages: 1207 passed, 0 failed, 4 ignored.
• Complete native Desktop workspace: 3750 passed, 0 failed, 21 ignored.
• Complete fork suite: 79 passed; patch registry validation and diff checks pass.
• Both locked all-features/all-targets graphs exclude serde_yaml and unsafe-libyaml.
• Three-way registry comparison confirms that neither parent's additions were lost.

Historical validation on df656115 remains applicable to the unchanged runtime sources: just ci desktop-typecheck, six shipping binary builds, complete seven-package tests (3060 passed), real CLI pack inspection and local CLI→relay→PostgreSQL YAML workflow create/read/update. Independent code review found no important regressions.

Current cargo-deny: FAIL, with seven advisories (RUSTSEC-2026-0365, 0367–0372) in negentropy, zip, zvariant, zbus_names, and zvariant_derive. Complete affected package records are identical to current main. These existing issues are outside this YAML migration; no new exceptions were added. The older audit PASS is historical only. Extra Desktop audit previously reported 11 other advisories shared with the pristine base.

Merge authorization and limits

The maintainer explicitly requested conflict resolution and merge on 2026-10-17 after receiving the review's audit and manual-acceptance limitations. That direct instruction supersedes the earlier draft-only handoff. Human native Desktop / live Kubernetes testing has not been reported, and no completed-review attestation is made. Ignored external/infrastructure tests remain ignored. The replacement retains translated unsafe ancestry; this change does not claim a memory-safety rewrite. No release or deployment is included.