fix: migrate off unsound serde_yml to serde_norway

serde_yml (RUSTSEC-2025-0068) and its libyml backend
(RUSTSEC-2025-0067) are archived, unsound, and unmaintained with no
patched version. Swap to serde_norway, the maintained serde_yaml fork
on unsafe-libyaml-norway — a drop-in for our from_str / to_string /
Value usage across persistence, undo, and the catalog parser.

Clears both advisories (cargo audit / osv-scanner / grype all clean;
serde_yml + libyml gone from the tree). No behaviour change; full
suite 2151/0/1.

src/undo.rs

@@ -412,7 +412,7 @@ impl SnapshotStore {
         let path = self.index_path();
         let mut index = if path.exists() {
             let body = fs::read_to_string(&path).map_err(|e| io_err("read index", &path, e))?;
-            serde_yml::from_str(&body).map_err(|e| SnapshotError::Index {
+            serde_norway::from_str(&body).map_err(|e| SnapshotError::Index {
                 message: e.to_string(),
             })?
         } else {
@@ -437,7 +437,7 @@ impl SnapshotStore {
 
     fn save_index(&self, index: &Index) -> Result<()> {
         create_dir_all(&self.root)?;
-        let body = serde_yml::to_string(index).map_err(|e| SnapshotError::Index {
+        let body = serde_norway::to_string(index).map_err(|e| SnapshotError::Index {
             message: e.to_string(),
         })?;
         let path = self.index_path();