Route every workspace yaml writer (allowBuilds, patchedDependencies,
catalog upsert/cleanup, config TUI key writes) through `yamlpatch`
instead of round-tripping through `yaml_serde::to_string`. yamlpatch
edits the original source surgically — keys, comments, and whitespace
the closure didn't touch land back on disk byte-identical, so the
daily install (cleanupUnusedCatalogs) and one-shot edits
(`approve-builds`, `patch-commit`, `patch-remove`,
`config set --location workspace`) no longer wipe user annotations.

`edit_workspace_yaml` keeps its closure-based public API. Internally
it diffs the parsed before/after `yaml_serde::Mapping`, reduces the
diff to a minimal sequence of `Add` / `Replace` / `Remove` patches,
and applies them via `yamlpatch::apply_yaml_patches`. The empty-file
path still falls through to `yaml_serde` since there are no
comments to preserve.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CI surfaced two yamlpatch issues the first version didn't catch:

1. `Op::Add { value: Mapping(...) }` for non-empty nested mappings
   strips the inner indentation hierarchy and emits invalid YAML
   (every nested line lands at the parent's column). Trips on
   first-time `catalogs:` upserts and any new `allowBuilds:` block.
2. `Op::Add { key }` interpolates the key verbatim, so a YAML-special
   key like `@pnpm.e2e/...` lands unquoted and breaks the document
   on the next parse — repros from the install-time auto-deny seed
   when the existing entry uses a quoted key.

Route every Add (mapping or scalar) through a small block-style
emitter that resolves the parent's byte span via `yamlpath`, infers
the child indent from `extract_with_leading_whitespace`, and
inserts a properly-quoted, properly-indented entry into the source
text. yamlpatch is still used for `Remove` and `Replace` — those
work correctly and are where the comment-preservation win lives.

Other fallout this commit cleans up:

- Drop `yamlpatch` / `yamlpath` / `serde_yaml` from `aube/Cargo.toml`.
  They were transitively pulled via `aube-manifest`; cargo-machete
  failed CI because nothing in the `aube` crate referenced them
  directly.
- Address Greptile P1: `to_serde_value` no longer `.expect()`s on
  fallible serialization; errors propagate as `crate::Error`.
- Address Greptile P2: non-string mapping keys now error out instead
  of being silently dropped from the diff.

New regression tests cover all three failure modes:
`edit_workspace_yaml_adds_nested_mapping_and_round_trips`,
`edit_workspace_yaml_adds_nested_mapping_under_existing_parent`,
`add_to_allow_builds_merges_with_quoted_existing_key`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…eful

Two follow-ups from the review bots on the previous commit:

1. `scalar_key_str` had a hand-rolled "safe character" set that
   omitted `@`, so non-leading-`@` keys like `b@2.0.0` and
   `is-positive@3.1.0` got unnecessarily double-quoted on the wire —
   contradicted the function's own doc string and produced style
   inconsistencies with the existing entries on disk. Defer to
   serde_yaml's emitter so plain-scalar quoting matches the rest of
   the file: `b@2.0.0` stays unquoted, `@scope/pkg@1.0.0` (leading
   reserved indicator) gets the canonical quoted form.

2. `clear_workspace_value` in the config TUI used to no-op silently
   on a workspace yaml whose top level wasn't a mapping (`Ok(false)`).
   Routing through `edit_workspace_yaml` turned that into a hard
   error. Restore the graceful path with a pre-flight check —
   clearing one key is a poor place to surface a parse error.

New tests pin both behaviors:
`upsert_workspace_patched_dependency_does_not_quote_unreserved_at_keys`,
`upsert_workspace_patched_dependency_quotes_leading_at_keys`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Cursor flagged the previous revision: silently mapping a yaml parse
error to `Ok(false)` masks genuine file corruption from the user. A
malformed workspace yaml is a real failure — surface it. Empty,
missing, and non-mapping top-level shapes stay graceful (matches the
pre-migration behavior of this command).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Three review-flagged latent issues in `yaml_patch::apply_diff`:

- `render_entry`'s catch-all arm fed sequence values through
  `render_scalar`, producing structurally invalid YAML when a sequence-
  valued key was added (`key: - a\n- b\n`). Add an explicit Sequence arm
  that emits block-style items at child indent, with a delegated path
  for the rare nested-mapping/sequence-in-list case.
- `Op::Replace` of a scalar with a non-empty mapping went through
  yamlpatch's same broken serializer as `Op::Add` and would land children
  at the parent's column. Detect the type-change and split into a
  Remove + manual injection so `inject_entry` re-emits children at the
  canonical indent.
- `detect_child_indent` fell back to a hard-coded column 2 for empty
  parents at depth >= 2, making new children siblings rather than
  descendants. Pass the parent's depth and use parent_depth *
  INDENT_STEP instead.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>