fix(yaml): accept empty flow mappings in mapping bodies

[pcristin]

What does this PR do?

Fixes #1673.

Goose serializes stdio extension siblings with an empty flow mapping such as
envs: {}. The YAML editor rejected every unquoted brace in mapping bodies,
so op=mcp_install could not update configuration that Goose itself had
written.

This change adds a narrow mapping-body exception for an exact empty mapping
value ({}). The key and prefix still pass through the existing fail-closed
scanner, and non-empty flow mappings remain unsupported.

Regression coverage verifies that:

• a realistic Goose sibling containing envs: {} is preserved byte-for-byte
  while the owned entry is appended;
• envs: {FOO: bar} is still rejected without changing the file; and
• unsupported key syntax such as <<: {} is still rejected without changing
  the file.

Validation:

• ASAN_OPTIONS=detect_leaks=0 scripts/test.sh --suites config_yaml_edit
  (47 passed)
• ASAN_OPTIONS=detect_leaks=0 scripts/test.sh --suites cli (278 passed)
• ASAN_OPTIONS=detect_leaks=0 scripts/test.sh
  (7,498 passed, 0 failed, 5 permitted platform skips)
• clang-format --dry-run --Werror src/cli/config_yaml_edit.c tests/test_config_yaml_edit.c
• git diff --check upstream/main..HEAD

scripts/lint.sh --ci still reports pre-existing findings in untouched files:
formatting in src/mcp/mcp.c and src/pipeline/pipeline_incremental.c, plus a
cppcheck style note in src/store/store.c.

Checklist

• Every commit is signed off (git commit -s) — required, CI rejects
  unsigned commits (DCO, see CONTRIBUTING.md)
• Tests pass locally (make -f Makefile.cbm test)
• Lint passes (make -f Makefile.cbm lint-ci)
• New behavior is covered by a test (reproduce-first for bug fixes)

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[DeusData]

Merged — thank you for a model contribution! The mapping-body-scoped exception is exactly the right shape for this editor (narrow, positional, fail-closed on the key side), and the byte-identity regression tests for the reject paths made this an easy review: verified end-to-end here against a Goose-serialized config (envs: {}) — op=mcp_install now writes the entry cleanly where v0.10.4/5 refused it. Much appreciated!