Strict-subset YAML decoding for native ConfigMap/DevicesMap values.

Contract: every accepted document decodes to exactly what the pinned go-yaml v4 UnmarshalYAML produces; everything else is rejected. Input outside the subset is rejected even when the native decoder would accept it.

Supported: one document holding a block or flow mapping (ConfigMap values are scalars; DevicesMap values are mappings of scalars), string keys, quoted/block scalars as strings, plain scalars resolved with go-yaml v4 rules, anchors on scalars and block mappings, aliases, and << merge keys (alias, mapping or sequence of those) with native precedence.

Rejected: explicit tags, directives, additional documents, sequences other than merge lists, nesting deeper than four collections, anchors inside flow collections or on keys, non-string plain keys, date-like plain scalars, more than 100 alias expansions and numeric forms outside the mirrored resolver. yamerl stops at the first rejected token, so pathological input is cheap.