chore(deps): rand 0.9.4 + compatible sweep + serde_yaml→serde_norway (#966)

Focused Rust dependency-maintenance pass from the 2026-05-23 security/freshness
review. No CVEs; one advisory cleared and one deprecated crate replaced.

- rand 0.9.2 → 0.9.4 (lockfile): clears RUSTSEC-2026-0097 (unsound with a
  custom logger using rand::rng()). Semver-compatible; rand 0.10 is a separate
  major.
- Compatible-update sweep: ~90 lockfile-only patch/minor bumps (bevy 0.18.0→
  0.18.1, clap 4.5→4.6, rayon 1.11→1.12, pathfinding 4.14→4.15, uuid 1.20→1.23,
  zerocopy, serde_json, tracing-subscriber, etc.). cargo test green.
- serde_yaml 0.9 (deprecated/archived upstream) → serde_norway 0.9, an actively
  maintained drop-in fork. In the server it is test-only (poi.rs round-trip,
  trait_modifiers.rs fixture, tests/news_ticker.rs) so it moves to
  dev-dependencies; line-previewer parses dialogue/monologue pool YAML at
  runtime, so it keeps it as a normal dependency. API is identical (from_str/
  to_string).

news_ticker.rs also picks up its share of the #967 clippy sweep (HashSet/HashMap
→ BTree, doc-list indent) since it is the same file as the serde rename.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tooling/line-previewer/src/main.rs

@@ -216,7 +216,7 @@ fn load_dialogue(path: &PathBuf) -> DialoguePool {
         eprintln!("Error reading {}: {e}", path.display());
         std::process::exit(1);
     });
-    serde_yaml::from_str(&yaml_str).unwrap_or_else(|e| {
+    serde_norway::from_str(&yaml_str).unwrap_or_else(|e| {
         eprintln!("Error parsing dialogue YAML: {e}");
         std::process::exit(1);
     })
@@ -227,7 +227,7 @@ fn load_monologue(path: &PathBuf) -> MonologuePool {
         eprintln!("Error reading {}: {e}", path.display());
         std::process::exit(1);
     });
-    serde_yaml::from_str(&yaml_str).unwrap_or_else(|e| {
+    serde_norway::from_str(&yaml_str).unwrap_or_else(|e| {
         eprintln!("Error parsing monologue YAML: {e}");
         std::process::exit(1);
     })

tooling/line-previewer/src/pipeline.rs

@@ -431,9 +431,9 @@ pub fn print_monologue_results(results: &[MonologueResult], verbose: bool, _seed
 
 pub fn print_coverage_report(yaml_str: &str, path: &Path) {
     // Try dialogue first, then monologue
-    if let Ok(pool) = serde_yaml::from_str::<DialoguePool>(yaml_str) {
+    if let Ok(pool) = serde_norway::from_str::<DialoguePool>(yaml_str) {
         print_dialogue_coverage(&pool, path);
-    } else if let Ok(pool) = serde_yaml::from_str::<MonologuePool>(yaml_str) {
+    } else if let Ok(pool) = serde_norway::from_str::<MonologuePool>(yaml_str) {
         print_monologue_coverage(&pool, path);
     } else {
         eprintln!("Error: file is neither dialogue nor monologue YAML");