Preserve source spans in project authoring YAML parsing

[jeremi]

Tracked by #399. Sibling of #396: that ticket defines the diagnostic envelope, this one supplies the source spans that make its locations precise. #393 depends on both.

Outcome

Project authoring diagnostics can point at exact source positions. The authoring pipeline retains span information for every addressable node in the five authored file roles, so the structured diagnostic envelope and the language server can anchor findings to precise ranges instead of whole files.

Background

• Authored project YAML is parsed with serde_yaml 0.9 through parse_yaml in crates/registryctl/src/project_authoring/output.rs. serde_yaml is archived upstream and yields a location only for parse errors; parsed values carry no spans.
• Semantic validation therefore has no path from a finding back to a source position today.
• In-tree precedent for a migration: registry-relay's runtime config already parses with serde-saphyr.

Suggested approach

Keep the typed model on serde and avoid rewriting it. Parse the same bytes a second time with a span-preserving parser to build a path-to-span index (a document path such as /integrations/0/outputs/2/name mapped to a source range). Diagnostics carry the document path; the index resolves it to a range at the output boundary. This confines the migration to the parsing layer.

Requirements

• No change to which projects are accepted or rejected.
• Spans available for mappings, sequence items, keys, and scalar values in all five authored file roles, as precisely as the parser permits.
• Store byte offsets internally; conversion to line/column (and to UTF-16 code units for LSP clients) happens at the output boundary.
• Deterministic and bounded: the index respects the existing bounded-file and path-confinement rules.
• Remove the serde_yaml dependency from registryctl when the migration completes.

Acceptance criteria

• Golden valid projects parse to the same model as before the migration.
• Unknown-field, invalid-enum, and invalid-type findings can be resolved to a precise range in the authored file.
• YAML syntax errors report positions at least as precise as today, and the existing schema-hint message behavior is preserved.
• Span lookup is covered by tests over flow-style and block-style YAML, quoted scalars, and aliases supported by the authoring parser.
• serde_yaml no longer appears in crates/registryctl dependencies.
• Parsing cost stays acceptable for editor use; the double parse is bounded by the existing project size limits.

Non-goals

• The diagnostic envelope, stable codes, and editor metadata (Expose versioned editor metadata and structured project diagnostics #396)
• The LSP transport and project indexing (Implement the Registry Stack project language server MVP #393)
• Migrating registry-manifest or relay runtime-config parsing