[elezar]

Summary

Replace direct serde_yml usage with a noyalib compatibility alias across the root workspace, Rust e2e harness, and governance interceptor example. This removes the direct libyml dependency that backs Dependabot alerts 1, 8, and 11 while keeping existing serde_yml:: call sites mostly stable.

Related Issue

Refs #2018

Addresses GitHub Dependabot security alerts for libyml via serde_yml 0.0.12:

• Dependabot alert 1
• Dependabot alert 8
• Dependabot alert 11

This does not close #2018 because the separate kube-client serde_yaml / unsafe-libyaml path remains out of scope.

Changes

• Switched direct serde_yml dependency declarations to noyalib 0.0.28 with compat-serde-yaml.
• Regenerated root, e2e, and governance example lockfiles, removing libyml from all three graphs.
• Adjusted the governance interceptor profile loader for noyalib mapping/from-value API differences.

Testing

• mise run pre-commit passes
• dev-openshell shell mise run pre-commit attempted; failed in existing helm:lint because chart metadata is missing postgresql
• cargo tree -i libyml no longer finds the package in root, e2e, or governance example graphs
• dev-openshell shell mise exec -- cargo check --all-targets -p openshell-policy -p openshell-prover -p openshell-providers -p openshell-router -p openshell-supervisor-network -p openshell-cli -p openshell-driver-mxc
• dev-openshell shell mise exec -- cargo check --manifest-path e2e/rust/Cargo.toml --all-targets --all-features
• dev-openshell shell mise exec -- cargo check --manifest-path examples/governance-interceptor/Cargo.toml --all-targets
• dev-openshell shell mise exec -- cargo test -p openshell-policy -p openshell-providers -p openshell-router -p openshell-prover
• dev-openshell shell mise exec -- cargo test -p openshell-supervisor-network opa
• dev-openshell shell mise exec -- cargo test -p openshell-cli output
• dev-openshell shell mise exec -- cargo test -p openshell-driver-mxc policy_mapper_matrix
• Focused Clippy passed for root YAML users, governance example, and e2e GPU target
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

Label test:e2e applied for 57b76aa. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.