Fail on YAML parse errors and quote policy values that need it

[arasHi87]

What type of PR is this?

/kind bug

What this PR does / why we need it

yml_util could hang the CLI and lose values.

• Reader hang. processLayer() ignored the result of yaml_parser_parse(). After a parse error libyaml returns empty events forever, so a policy value such as note: a: b made hex_translate spin and hex_cli … configure never returned. processLayer now returns -1 on a parse error or YAML_NO_EVENT, and ReadYml logs Failed to parse policy file <file>: <problem> at line L, column C and returns -1. Every caller already handled < 0.
• Writer quoting. writeNode() wrote leaf values raw, so a: b, x # y, a leading # (Slack #general, cubecos#1780), leading or trailing blanks and similar values became invalid or truncated YAML. Such values are now single-quoted, or double-quoted with escapes when they hold control characters. Values that round-tripped before (booleans, numbers including -1, hosts, URLs, already-quoted values) are written byte for byte as before.
• Tuning default. Tunings.enabled was uninitialised; it now defaults to true, as TuningPolicy::clear() does, so a missing key no longer yields stack garbage.

Which issue(s) this PR fixes

Refs bigstack-oss/cubecos#1956
Refs bigstack-oss/cubecos#1780

bigstack-oss/cubecos#2050 bumps this submodule and closes both tickets; it depends on this PR.

QA

QA-Status: Not needed

Test evidence

New test_api_03 (parse errors and a write/read round trip of 20+ awkward values) passes; test_api_01/02 still pass (CentOS Stream 9 container, libyaml 0.2.5, 2026-10-11). On develop's yml_util.c test_api_03 spins until timeout (rc 124). Blind verification on a single-node 3.2.0 lab cluster, 2026-10-11: FIXED for #1956 and #1780.

yml_util tests: this branch, develop, and reader-fix-only

# CentOS Stream 9 amd64 container, libyaml 0.2.5, gcc -Wall -Werror; each test_api_NN.sh run under set -o pipefail
# new = this branch; old = develop yml_util.c; readeronly = reader fix with the old writer
new test_api_01: rc=0
new test_api_02: rc=0
new test_api_03: rc=0
old test_api_01: rc=0
old test_api_02: rc=0
old test_api_03: rc=124
readeronly test_api_01: rc=0
readeronly test_api_02: rc=0
readeronly test_api_03: rc=134

Blind verification: verdict excerpt

QA row	Verdict
QA1: add receiver email ... "a: b" applies and does not hang	FIXED. "Policy changes were successfully applied.", rc=0, 56.8 s (under the 120 s timeout)
QA2: a: b round-trips	FIXED. list shows Note: a: b, the raw line is note: 'a: b', settings.txt has emails.0.note = a: b
QA2b: a value with # round-trips	FIXED. Note: # hash, raw note: '# hash'
QA3: no hex_translate process and no lock afterwards	FIXED
QA4: delete receiver	FIXED. Success text, receivers gone
Malformed file returns an error and does not hang	FIXED. hex_translate translate returned rc=1 in 0.010 s; log: Failed to parse policy file …/alert_setting1_0.yml: mapping values are not allowed in this context at line 17, column 14
#1780: Slack #channel round-trips	FIXED. list shows Channel #rt694-v1956, raw channel: '#rt694-v1956', the UI/API return name: "#rt694-v1956"

/etc/policies ended identical to the snapshot.

Special notes for your reviewer

Note

• Start at processLayer/ReadYml in src/hex_sdk_library/yml_util/yml_util.c, then scalarStyle/writeScalar; tests/test_api_03.c lists every value checked.
• Deliberate choices: a value that is already one complete quoted scalar is written raw, because cubecos policy_notify_trigger.cpp quotes the alert_resp match itself. -, ? and : are quoted only when followed by a blank, so negative numbers stay numbers.
• Risk: yml_util.c is in libhex_sdk.a, so hex_translate, hex_cli, hex_firsttime and hex_config pick it up. A malformed file now fails cleanly instead of spinning or returning a partial tree.
• Not in scope: the hex_cli one-liner still exits 0 after "Unexpected error"; U+2028/C1 characters are written raw.
• Rollback: revert both commits (and the cubecos bump).