fix(deps): replace the unmaintained YAML parser blocking CI #2278

Problem

The CUDA implementation batch cannot pass CI because cargo-deny rejects unsafe-libyaml 0.2.11 under RUSTSEC-2024-0449. The dependency is already present on main through the two direct serde_yaml 0.9 dependencies. CI run 38258626808 fails only this advisory check; its other checks pass.

Required change

Replace the unmaintained YAML parser dependency in the CLI and surgery crate with a maintained safe-Rust parser such as serde-saphyr, without suppressing the advisory. Preserve the existing language-bias and surgery configuration contracts, including ordered entries, duplicate-key rejection, DuplicateLanguageCode reporting, supported numeric syntax, enum representations, and existing example files. Parser implementation types do not appear in public APIs.

Acceptance criteria

• serde_yaml and unsafe-libyaml are absent from the resolved workspace dependency graph.
• Existing language-bias and surgery configuration tests and configuration examples remain valid.
• Duplicate language codes retain their specific CLI error; duplicate top-level fields are still rejected.
• Formatting, focused tests, Clippy, and cargo deny check pass.
• The PR documents any deliberate compatibility change rather than silently changing parser behavior.

Evidence

• Advisory: https://rustsec.org/advisories/RUSTSEC-2024-0449.html
• Failed CI: https://github.com/lablup/mlxcel/actions/runs/38258626808
• Current dependency declarations: Cargo.toml and src/lib/mlxcel-surgery/Cargo.toml.
• Current consumers: src/lang_bias.rs and src/lib/mlxcel-surgery/src/config.rs.

This is a shared CI prerequisite discovered while validating #2142 and #1784; it does not change their implementation scope.