fix: migrate off archived serde_yaml; cap config size at 1 MiB

[walter-square]

The Problem

serde_yaml is the YAML parser facing untrusted input (repo configs) on every git invocation, and it's archived/deprecated upstream — future advisories won't be patched.

The Fix

• Swaps serde_yaml 0.9.34 for the maintained serde_yaml_ng 0.10.0, aliased back to the serde_yaml package name so no call sites change.
• Adds a 1 MiB size cap when loading config files. Real lefthook configs are sub-10 KiB; a config exceeding 1 MiB now fails loudly rather than risking unbounded parse/alloc.

Testing

• cargo test (147 passing, including the size-cap path).