feat(plane): manifest schemas and validation (task 1)

Add openultrasast.plane.manifests: frozen dataclasses and loaders for ax's
Task, Workspace and Model kinds (ax.io/v1alpha1, ax's fields only) and the
Run kind (openultrasast.io/v1alpha1: tasks, dependsOn, inputs, outputs,
budget, serialize). Every violation raises ManifestError naming the kind,
metadata.name and field path: unknown fields at any depth, wrong apiVersion
or kind, a provider outside google/anthropic unless deepseek is declared via
the openultrasast.io/provider-extension annotation, a Run with a dependency
cycle, an input naming no task, and a Run task naming no loaded Task.
load_manifests reads multi-document YAML files and indexes by kind and name.

PyYAML becomes the one declared core dependency; the two zero-dependency
guards now pin exactly that, and the module audit registers the plane
package under the ai-service-plane spec.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

pyproject.toml

@@ -8,13 +8,13 @@ version = "1.2.0a1"
 description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
 readme = "README.md"
 requires-python = ">=3.11"
-dependencies = []
+dependencies = ["pyyaml>=6.0"]
 
 [project.optional-dependencies]
 # HarnessX is the optional agentic plane (LLM hunter/verifier + self-improvement).
 # SHA-pinned for reproducibility; the heavy transitive footprint (see
 # .kiro/specs/harnessx-self-improving-rulesets/dependency-audit.md) lands ONLY when
-# this extra is installed. The core install stays zero-dependency and every HarnessX
+# this extra is installed. The core install declares only PyYAML (plane manifests) and every HarnessX
 # import is guarded by openultrasast.harness_ext (lazy). pip does not pull the
 # recipe/verl_harnessX submodule (it is outside the packaged harnessx* modules).
 harnessx = [
@@ -73,6 +73,11 @@ ignore_missing_imports = true
 module = "tree_sitter"
 ignore_missing_imports = true
 
+# PyYAML ships no inline types and types-PyYAML is not a dev dependency.
+[[tool.mypy.overrides]]
+module = "yaml"
+ignore_missing_imports = true
+
 [dependency-groups]
 dev = [
     "dagger-io>=0.21.7",