refactor: 依赖健康度改进 — serde_yaml 迁移 + workspace 统一声明

- zclaw-pipeline: serde_yaml 0.9 → serde_yaml_bw 2.x (drop-in fork, panic-free)
  使用 package rename 保持代码中 use serde_yaml 不变
- zclaw-saas: regex/aes-gcm/bytes 改为 workspace 统一声明
  urlencoding/data-encoding 保留为 crate-local (仅此 crate 使用)

crates/zclaw-pipeline/Cargo.toml

@@ -12,7 +12,7 @@ tokio = { workspace = true }
 futures = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-serde_yaml = "0.9"
+serde_yaml = { package = "serde_yaml_bw", version = "2" }
 thiserror = { workspace = true }
 anyhow = { workspace = true }
 tracing = { workspace = true }

crates/zclaw-saas/Cargo.toml

@@ -43,9 +43,9 @@ argon2 = { workspace = true }
 totp-rs = { workspace = true }
 urlencoding = "2"
 data-encoding = "2"
-regex = "1"
-aes-gcm = "0.10"
-bytes = "1"
+regex = { workspace = true }
+aes-gcm = { workspace = true }
+bytes = { workspace = true }
 
 [dev-dependencies]
 tempfile = { workspace = true }