chore: replace gopkg.in/yaml.v3 with go.yaml.in/yaml/v3

We had three YAML modules. Two were the same library under old and new paths. gopkg.in/yaml.v3 is frozen. The maintained path is go.yaml.in/yaml/v3, already used in internal/plan.

Shipped in #15: all direct gopkg.in/yaml.v3 imports moved to go.yaml.in/yaml/v3. Kept sigs.k8s.io/yaml for the JSON-bridge path (specs, K8s types).

v4 is a follow-up (#14), blocked on dyff/ytbx.