fix(pm): isolate bootstrap dependencies and unify YAML on ruamel

Activation reaches plugin discovery before the application dependencies
exist. Give PM its own locked Python project and runtime so it can install
or repair the application without importing that dependency tree.

Keep PM outside the application workspace. A shared uv workspace resolves
the application graph and cannot provide this isolation. Route mutations
through an isolated worker and preserve transaction callbacks, cancellation,
custom package registrations, and correlated receipts.

Use the same runtime builder for source installs and packaged payloads.
Keep offline wheelhouse support in that builder. Nix builds the independent
PM lock as a separate derivation. Refuse lazy-disabled bootstrap before
installing tools or dependencies.

Move first-party YAML readers and writers to ruamel. Keep the application
lock's transitive PyYAML requirements for third-party packages.

Verification:
- Focused canonical Python suite: 177 passed, 1 host-gated skip.
- Electron backend probes: 12 passed. Electron typecheck passed.
- Both uv locks, scoped lint, Bash syntax, and whitespace checks passed.
- Cold activation, corrupt-app repair, offline staging, and relocation ran.
- Built and exercised the Nix PM runtime and standalone YAML merge script.

Six broader caller test files retain the same 24 failing test IDs as an
archive of HEAD. The existing real-home guard blocks those tests before
they can exercise the affected paths. No full-suite pass is claimed.
Native Windows signing and full Bionic package execution remain unverified.

hermes_yaml.py

@@ -0,0 +1,77 @@
+"""Shared YAML 1.1 policy for config, manifests, and frontmatter.
+
+Ruamel's native schema includes bare y/n booleans and rejects duplicate keys.
+Every operation owns its parser/emitter; instances must not be shared by threads.
+"""
+
+from io import StringIO
+from typing import Any, IO, overload
+
+from ruamel.yaml import YAML
+from ruamel.yaml.error import YAMLError as YAMLError
+from ruamel.yaml.resolver import VersionedResolver
+
+
+class _Yaml11Resolver(VersionedResolver):
+    # Quote strings like "off" without adding a %YAML directive to every config/snippet.
+    @property
+    def processing_version(self) -> tuple[int, int]:
+        return (1, 1)
+
+
+def safe_load(stream: str | bytes | IO[str] | IO[bytes]) -> Any:
+    """Read standard YAML data; existing configs use YAML 1.1 booleans."""
+    yaml = YAML(typ="safe")
+    yaml.version = (1, 1)
+    return yaml.load(stream)
+
+
+@overload
+def safe_dump(
+    data: Any, stream: None = None, *, default_flow_style: bool = False,
+    sort_keys: bool = True, allow_unicode: bool = True, width: int = 80,
+) -> str: ...
+
+
+@overload
+def safe_dump(
+    data: Any, stream: IO[str], *, default_flow_style: bool = False,
+    sort_keys: bool = True, allow_unicode: bool = True, width: int = 80,
+) -> None: ...
+
+
+def safe_dump(
+    data: Any,
+    stream: IO[str] | None = None,
+    *,
+    default_flow_style: bool = False,
+    sort_keys: bool = True,
+    allow_unicode: bool = True,
+    width: int = 80,
+) -> str | None:
+    """Write standard YAML data with readable Unicode and indented block lists."""
+    # The C emitter ignores sequence offsets and escapes astral Unicode.
+    yaml = YAML(typ="safe", pure=True)
+    yaml.Resolver = _Yaml11Resolver
+    yaml.default_flow_style = default_flow_style
+    yaml.allow_unicode = allow_unicode
+    yaml.width = width
+    yaml.sort_base_mapping_type_on_output = sort_keys
+    yaml.indent(mapping=2, sequence=4, offset=2)
+    if stream is not None:
+        yaml.dump(data, stream)
+        return None
+    output = StringIO()
+    yaml.dump(data, output)
+    return output.getvalue()
+
+
+def roundtrip_yaml() -> YAML:
+    """Create a fresh comment/quote-preserving editor for user-authored YAML."""
+    yaml = YAML(typ="rt")
+    yaml.Resolver = _Yaml11Resolver
+    yaml.preserve_quotes = True
+    yaml.allow_unicode = True
+    yaml.default_flow_style = False
+    yaml.indent(mapping=2, sequence=4, offset=2)
+    return yaml