… parsing

The workspace had two YAML parsers — both forks of the archived
`dtolnay/serde-yaml`. `mergify-config` used `serde_norway` for
`.mergify.yml`; `mergify-ci` used `serde_yaml_ng` for merge-queue
metadata in PR bodies and git notes. Same job, two crates, two
transitive `unsafe-libyaml*` trees in Cargo.lock.

Standardize on `serde_yaml_ng` for both. The decision is grounded
in concrete signal, not vibe:

  Metric                     serde_norway   serde_yaml_ng
  ─────────────────────────  ─────────────  ─────────────
  Reverse-deps on lib.rs     229 (78 dir.)  618 (349 dir.)
  GitHub stars               53             109
  Last commit                2025-08-04     2025-09-14
  Bus factor (recent prs)    1 (solo)       merges externals
  Maintainer statement       v0.9.40 title  README: explicit
                             "I'm gonna       upstream-compat
                              maintain this"  intent
  unsafe-libyaml backend     forked ("…-    canonical
                             norway")
  Open since                 2024-06-10     2024-05-03
  License                    Apache-2.0     MIT (= upstream)

`serde_yaml_ng` wins on every axis that matters for the "will this
still be alive in two years" question: three-times the ecosystem
adoption, more recent activity, accepts third-party PRs, declares
the maintenance commitment in writing, and uses the canonical
`unsafe-libyaml` rather than a parallel-fork backend.

Functional surface is identical for both of our use shapes —
`from_str` to a typed struct for ci, `from_str` to `Value`
then convert to `serde_json::Value` for config validation.
Migration is purely a rename at the one call site.

Cargo.lock drops `serde_norway` and `unsafe-libyaml-norway`.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Change-Id: If5d28d2c4259127181bace5bafb0ac02c78d8f7b

Pin the contract before porting `ci scopes` to Rust. The new test
exercises the "no base provided" branch — pass `--head HEAD`
without `--base` and the command must list every configured scope
as touched. This is the one execution path through `ci scopes`
that doesn't shell out to `git diff`, so the test stays hermetic
inside the tmp dir the `cli` fixture runs in (no git init, no
remote fetch, no Mergify API).

The Python implementation passes today. The follow-up port lands
on top and the same smoke test exercises the Rust binary,
catching any wire-format or exit-code drift between the two
implementations.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Change-Id: I14468b7046c449104675aea0a07a273eab479316