Replace lyaml with api7-lua-tinyyaml and prepare the 0.1.0 releasev0.1.0

lyaml binds the system libyaml, which luarocks does not vendor, so
installing the rock failed wherever that library was absent, taking the
whole extension down on a stock macOS machine. api7-lua-tinyyaml is pure
Lua and matches lyaml on every quoting, escaping and block-scalar form
profiles use.

What the subset costs: anchors and aliases are not resolved, and plain
multi-line scalars raise. The raise surfaces through the existing parse
warning, but an unresolved alias came back as the literal "*alias"
string and would have become a profile name, so frontmatter.parse now
detects those keys, drops them, and warns.

Point source.url at code.tjp.lol with a v0.1.0 tag, replacing a GitHub
URL that never existed. Add a LICENSE file and mise release tasks, and
fix the README dependency-install command, which called a luarocks.cmd
function that does not exist.

4 files changed, 32 insertions, 26 deletions

diff --git a/spec/run.lua b/spec/run.lua
index ee9f432..5476e7b 100644
--- a/spec/run.lua
+++ b/spec/run.lua
@@ -2,7 +2,7 @@
 --
 -- Expected environment. Plain Lua 5.4 with the repo root on package.path, which
 -- this file arranges from `arg[0]`, plus the rocks the extension depends on
--- (lyaml, toml2lua, luv) and dkjson for the specs' JSON decoding. `mise run
+-- (api7-lua-tinyyaml, toml2lua, luv) and dkjson for the specs' JSON decoding. `mise run
 -- check` puts the ./.rocks tree on LUA_PATH/LUA_CPATH first and is the intended
 -- entry point; a bare `lua spec/run.lua` also works if those rocks are on the
 -- default path. `panto lua spec/run.lua` works too — panto's own rocks tree
diff --git a/spec/test_frontmatter.lua b/spec/test_frontmatter.lua
index 3f0c4c5..f729254 100644
--- a/spec/test_frontmatter.lua
+++ b/spec/test_frontmatter.lua
@@ -2,18 +2,18 @@
 --
 -- The body is the part a broken header must never cost the user, so every
 -- degraded case is checked for "body preserved verbatim" as well as for the
--- warning. Cases that actually parse YAML need lyaml and skip without it.
+-- warning. Cases that actually parse YAML need tinyyaml and skip without it.
 
 local frontmatter = require("subagents.frontmatter")
 
-local function lyaml_or_skip()
-    return pcall(require, "lyaml")
+local function yaml_or_skip()
+    return pcall(require, "tinyyaml")
 end
 
 return {
     { "fenced header parses and keeps the body verbatim", function()
-        if not lyaml_or_skip() then
-            return "skip", "lyaml is not installed"
+        if not yaml_or_skip() then
+            return "skip", "tinyyaml is not installed"
         end
         local body = "You are a reviewer.\n\n  indented line  \n"
         local data, parsed_body, warning = frontmatter.parse(
@@ -27,8 +27,8 @@ return {
     end },
 
     { "CRLF fences are tolerated", function()
-        if not lyaml_or_skip() then
-            return "skip", "lyaml is not installed"
+        if not yaml_or_skip() then
+            return "skip", "tinyyaml is not installed"
         end
         local data, body, warning = frontmatter.parse("---\r\nname: crlf\r\n---\r\nbody\r\n")
         assert(warning == nil, tostring(warning))
@@ -59,26 +59,32 @@ return {
         assert(warning == nil, tostring(warning))
     end },
 
-    { "broken YAML warns and keeps the body", function()
-        if not lyaml_or_skip() then
-            return "skip", "lyaml is not installed"
+    { "a header the parser rejects warns and keeps the body", function()
+        if not yaml_or_skip() then
+            return "skip", "tinyyaml is not installed"
         end
-        local data, body, warning = frontmatter.parse("---\na: [unclosed\n---\nbody\n")
-        assert(data == nil, "a broken header must not produce metadata")
+        local data, body, warning = frontmatter.parse("---\njust a string\n---\nbody\n")
+        assert(data == nil, "a rejected header must not produce metadata")
         assert(body == "body\n", string.format("%q", body))
         assert(type(warning) == "string" and warning:find("did not parse", 1, true),
             "expected a parse warning, got " .. tostring(warning))
     end },
 
-    { "a non-mapping document warns and keeps the body", function()
-        if not lyaml_or_skip() then
-            return "skip", "lyaml is not installed"
+    { "an unresolved alias is dropped rather than read literally", function()
+        if not yaml_or_skip() then
+            return "skip", "tinyyaml is not installed"
         end
-        local data, body, warning = frontmatter.parse("---\njust a string\n---\nbody\n")
-        assert(data == nil, "a scalar header must not produce metadata")
+        -- tinyyaml does not resolve aliases: without the guard in parse(), the
+        -- `*d` token would arrive as the literal string "*d" and become this
+        -- profile's name.
+        local data, body, warning = frontmatter.parse(
+            "---\ndefs: &d my-agent\nname: *d\n---\nbody\n")
+        assert(type(data) == "table", "the mapping itself should survive")
+        assert(data.name == nil, "an alias must not become a value, got " .. tostring(data.name))
+        assert(data.defs == nil, "an anchor must not become a value, got " .. tostring(data.defs))
         assert(body == "body\n", string.format("%q", body))
-        assert(type(warning) == "string" and warning:find("not a mapping", 1, true),
-            "expected a mapping warning, got " .. tostring(warning))
+        assert(type(warning) == "string" and warning:find("anchors/aliases", 1, true),
+            "expected an alias warning, got " .. tostring(warning))
     end },
 
     { "empty input is empty output", function()
diff --git a/spec/test_init.lua b/spec/test_init.lua
index 5d2f8d9..eb8777a 100644
--- a/spec/test_init.lua
+++ b/spec/test_init.lua
@@ -5,7 +5,7 @@
 -- lifecycle subscription is invisible until a user notices the tools are gone or
 -- a cancelled turn leaves children running. Discovery is pointed at a temporary
 -- config layer, so the assertions do not depend on this machine's ~/.config; the
--- first case skips when luv or lyaml is missing because the profile it looks for
+-- first case skips when luv or tinyyaml is missing because the profile it looks for
 -- could not be read without them.
 
 local fake = require("spec.fake_ext")
@@ -55,8 +55,8 @@ return {
         if not ok_uv then
             return "skip", "luv is not installed"
         end
-        if not pcall(require, "lyaml") then
-            return "skip", "lyaml is not installed"
+        if not pcall(require, "tinyyaml") then
+            return "skip", "tinyyaml is not installed"
         end
 
         local tmp = assert(uv.fs_mkdtemp("/tmp/panto-subagents-init-XXXXXX"))
diff --git a/spec/test_profiles.lua b/spec/test_profiles.lua
index f2a54a2..680679f 100644
--- a/spec/test_profiles.lua
+++ b/spec/test_profiles.lua
@@ -4,7 +4,7 @@
 -- real config, by passing explicit roots to `discover` — the same seam the
 -- extension uses for the user and project layers, in the same order.
 --
--- Needs luv (the recursive walk) and lyaml (the frontmatter); without either the
+-- Needs luv (the recursive walk) and tinyyaml (the frontmatter); without either the
 -- whole file skips rather than asserting on a degraded parse.
 
 local profiles = require("subagents.profiles")
@@ -22,8 +22,8 @@ local function discover_fixture()
     if not ok_uv then
         return nil, "luv is not installed"
     end
-    if not pcall(require, "lyaml") then
-        return nil, "lyaml is not installed"
+    if not pcall(require, "tinyyaml") then
+        return nil, "tinyyaml is not installed"
     end
 
     local tmp = assert(uv.fs_mkdtemp("/tmp/panto-subagents-profiles-XXXXXX"))