build(deps): replace serde_yaml with serde-saphyr

[antiguru]

serde_yaml is deprecated, and it depends on the unmaintained unsafe-libyaml (RUSTSEC-2024-0449). mz-debug and mz-metrics-catalog only write YAML, so this PR moves both to serde-saphyr, built with only its serialize feature. kube-client already depends on serde-saphyr since #39355. With serde_yaml gone, unsafe-libyaml leaves the dependency tree, and its advisory ignore in deny.toml goes with it.

The PR also regenerates doc/user/data/metrics.yml. Its content is unchanged: all 799 entries parse to the same data as before. The formatting differs in two ways. Quoted names use double quotes instead of single quotes, and long help strings become folded block scalars. YAML that mz-debug writes for Kubernetes objects changes in the same ways.

It also drops the ignores for RUSTSEC-2026-0173 and RUSTSEC-2026-0253, which cargo deny no longer detects on main.

🤖 Generated with Claude Code

[Alphadelta14]

pretty straightforward. I just had run through this but had to adopt the diverged Error interfaces, which doesn't seem to apply here.

[def-]

QA LLM Review

1. MEDIUM -- Catalog name regexes keep the new double quotes, so catalog-diff reports 12 live metric families as removed

.agents/skills/mz-release-signoff/scripts/catalog_names.py:20

catalog_names.py and lint_metrics.py extract metric names from doc/user/data/metrics.yml with ^- name: '?(.+?)'?$, which strips only single quotes. serde-saphyr writes the 12 glob names as "*_requests_total" etc., so both scripts now return names that still carry literal " characters. As a result, catalog-diff.sh misreports live metrics during release sign-off, and lint-skill-metrics.sh fails.

Details

Running catalog-diff.sh ae4f9b74f7 3582f70324 lists all of *_postgres_connpool_*, *_request_duration_seconds_*, *_requests_active and *_requests_total under "Removed (an after-window on these is empty by construction)", with quoted copies under "Added". The release sign-off skill says to treat a name in the removed list as "a documentation fix rather than a finding". On any sign-off whose tag range spans this PR, an empty HTTP-request or persist-connpool panel would therefore be explained away when it could be a real regression. CI does not exercise catalog_names.py.

lint_metrics.py:24 has the same regex. That is why lint-docs is red on this PR: mz_http_requests_total and mz_http_request_duration_seconds_bucket no longer match the quoted globs. The lint message suggests adding them to the allowlist, but that would hide the real cause.

Fix: accept both quote styles in both scripts, for example ^- name: (['"]?)(.+?)\1$ (group 2). Old and new tags then parse to the same names.

[antiguru]

Fixed in 21eea58. Both catalog_names.py and lint_metrics.py now accept either quote style via ^- name: (['"]?)(.+?)\1$. catalog_names.py returns the same name set for ae4f9b74f7 (single quotes) and this branch (double quotes), and ci/test/lint-skill-metrics.sh passes locally. The Hugo metrics-table shortcode reads the file through a YAML parser, so the quote change doesn't affect it.

Posted by Claude Code

[antiguru]

3bbb1e1 replaces the regex fix: catalog_names.py and lint_metrics.py now parse the catalog with yaml.safe_load and run through bin/pyactivate for PyYAML. Changes to the generator's formatting can no longer change the extracted names. catalog-diff.sh ae4f9b74f7 HEAD reports no added or removed metrics, and ci/test/lint-skill-metrics.sh passes.

Posted by Claude Code

[antiguru]

Thanks for the review!