refactor: 依赖健康度改进 — serde_yaml 迁移 + workspace 统一声明

- zclaw-pipeline: serde_yaml 0.9 → serde_yaml_bw 2.x (drop-in fork, panic-free)
  使用 package rename 保持代码中 use serde_yaml 不变
- zclaw-saas: regex/aes-gcm/bytes 改为 workspace 统一声明
  urlencoding/data-encoding 保留为 crate-local (仅此 crate 使用)

Cargo.lock

@@ -137,6 +137,12 @@ dependencies = [
  "password-hash",
 ]
 
+[[package]]
+name = "arraydeque"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
+
 [[package]]
 name = "async-broadcast"
 version = "0.7.2"
@@ -4677,6 +4683,17 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "saphyr-parser-bw"
+version = "0.0.610"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d643f5e972f17219245b82f038c22cd3c74320bb17c6e8f7e8537de268b1bc6"
+dependencies = [
+ "arraydeque",
+ "smallvec",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "schannel"
 version = "0.1.29"
@@ -4984,6 +5001,23 @@ dependencies = [
  "unsafe-libyaml",
 ]
 
+[[package]]
+name = "serde_yaml_bw"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b4d05b26468431333c4d16963433fe0e04ef24e4a7b568c9da81e91d25c0dbb"
+dependencies = [
+ "base64 0.22.1",
+ "indexmap 2.13.0",
+ "itoa",
+ "num-traits",
+ "regex",
+ "saphyr-parser-bw",
+ "serde",
+ "unsafe-libyaml-norway",
+ "zmij",
+]
+
 [[package]]
 name = "serialize-to-javascript"
 version = "0.1.2"
@@ -6541,6 +6575,12 @@ version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
 
+[[package]]
+name = "unsafe-libyaml-norway"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39abd59bf32521c7f2301b52d05a6a2c975b6003521cbd0c6dc1582f0a22104"
+
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -8256,7 +8296,7 @@ dependencies = [
  "reqwest 0.12.28",
  "serde",
  "serde_json",
- "serde_yaml",
+ "serde_yaml_bw",
  "thiserror 2.0.18",
  "tokio",
  "tokio-test",

crates/zclaw-pipeline/Cargo.toml

@@ -12,7 +12,7 @@ tokio = { workspace = true }
 futures = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-serde_yaml = "0.9"
+serde_yaml = { package = "serde_yaml_bw", version = "2" }
 thiserror = { workspace = true }
 anyhow = { workspace = true }
 tracing = { workspace = true }

crates/zclaw-saas/Cargo.toml

@@ -43,9 +43,9 @@ argon2 = { workspace = true }
 totp-rs = { workspace = true }
 urlencoding = "2"
 data-encoding = "2"
-regex = "1"
-aes-gcm = "0.10"
-bytes = "1"
+regex = { workspace = true }
+aes-gcm = { workspace = true }
+bytes = { workspace = true }
 
 [dev-dependencies]
 tempfile = { workspace = true }