refactor: 依赖健康度改进 — serde_yaml 迁移 + workspace 统一声明

- zclaw-pipeline: serde_yaml 0.9 → serde_yaml_bw 2.x (drop-in fork, panic-free)
  使用 package rename 保持代码中 use serde_yaml 不变
- zclaw-saas: regex/aes-gcm/bytes 改为 workspace 统一声明
  urlencoding/data-encoding 保留为 crate-local (仅此 crate 使用)

crates/zclaw-pipeline/Cargo.toml

@@ -12,7 +12,7 @@ tokio = { workspace = true }
 futures = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-serde_yaml = "0.9"
+serde_yaml = { package = "serde_yaml_bw", version = "2" }
 thiserror = { workspace = true }
 anyhow = { workspace = true }
 tracing = { workspace = true }