feat(deps): migrate to js-yaml v5

[dyoshikawa]

Summary

Migrates js-yaml from 4.2.0 to 5.2.1 (a major version that was held back from the #2114 dependabot group bump due to a breaking empty-input change).

js-yaml v5 changed load("") to throw (expected a document, but the input is empty) instead of returning undefined. Several parsers here relied on the old undefined sentinel, so a naive bump broke them.

Approach

Centralized empty-input guard. Rather than patch each call site ad hoc, this adds loadYaml (src/utils/yaml.ts) — a thin wrapper that:

• returns undefined for empty / whitespace-only / comment-only documents (matching v4), and
• re-throws genuine parse errors unchanged (detected via YAMLException.reason === "expected a document, but the input is empty").

Every js-yaml load call now routes through loadYaml, so the v4 contract lives in one place and a future bump cannot silently reintroduce the regression.

Dependency changes:

• js-yaml 4.2.0 → 5.2.1
• Dropped @types/js-yaml — v5 is written in TypeScript and ships its own type declarations.

Scope of breaking changes actually hit: the codebase already used named imports (import { load, dump }), no default import, no custom Type API, and none of v5's removed dump options (styles/replacer/noCompatMode/condenseFlow/quotingType/noArrayIndent) — only lineWidth/noRefs/sortKeys, all retained. So dump needed no changes.

Bugs fixed

Beyond the two documented breakages:

• parseApmManifest (apm-manifest.ts) — empty apm.yml now returns { dependencies: [] } instead of throwing.
• injectSourceMetadata (gh-frontmatter.ts) — empty frontmatter block (---\n---) is treated as an empty block, not invalid frontmatter.

…the migration also fixed several undocumented sites with the same "empty file parses to undefined/null" assumption inside a try/catch: goose-command, goose-mcp, goose-subagent, roo-subagent (an empty file would have thrown a "Failed to parse …" error under a naive v5 bump).

Verification

• loadYaml unit tests cover empty / whitespace / comment-only / valid / invalid inputs.
• Existing empty-input regression tests (apm-manifest.test.ts, gh-frontmatter.test.ts) stay green.
• Full unit suite: 6918 pass.
• YAML-related e2e (mcp, permissions, commands, subagents, skills): 437 pass — these assert on generated YAML byte-for-byte, empirically confirming v5 dump output is compatible across the Tool × Feature matrix.
• pnpm cicheck green.

Note: this touches package.json / lockfile (a dependency manifest). The maintainer explicitly authorized driving this one through to merge.

Closes #2122

🤖 Generated with Claude Code

[dyoshikawa]

@dyoshikawa Thank you!