Linter migration to a position-preserving YAML parser

[mostafa]

Summary

Migrate the linter off heuristic path-to-span resolution onto a position-preserving YAML parse (saphyr/serde-saphyr) so duplicate detection keys and accurate diagnostics become possible.

Motivation

serde_yaml-style deserialization collapses duplicate keys and forces text heuristics for spans. Rare authoring mistakes become silent overwrites, and diagnostics can mis-point on quoted or flow-style YAML.

Proposed approach

• Swap yaml representation across parser/linter crates onto MarkedYaml-capable types.
• Wire real spans into lint diagnostics; remove heuristic resolvers.
• Add duplicate-key detection for detection sections.
• Re-validate fix suggestions and LSP integration against the new spans.

Out of scope

• Changing Sigma semantics beyond duplicate-key reporting.
• A full YAML formatter (separate LSP feature).

Tasks

• Phase 1: representation swap with green tests
• Phase 2: MarkedYaml spans in linter
• Phase 3: duplicate-key lint
• LSP/fix revalidation
• Docs: lint catalogue

References

• Linter modules under rsigma-cli/rsigma-parser lint paths
• Existing yaml_serde usage after prior serde_yaml removal