ci/main-green: parse ci.yml with the declared js-yaml package (#13955)

validate-release-green imported the yaml package, which is not a
direct dependency on main. The nightly job then crashed before the
verdict fence, so the tracker comment was empty. js-yaml is already
declared and load() is the same parse for this workflow YAML.

Signed-off-by: Minxi Hou <houminxi@gmail.com>

changelog.d/fixes/main-green-js-yaml.md

@@ -0,0 +1 @@
+- **fix(ci):** `validate-release-green` parses `ci.yml` with the already-declared `js-yaml` dependency instead of the undeclared `yaml` package, so a main-green nightly crash no longer posts an empty verdict on the tracker.

scripts/quality/validate-release-green.mjs

@@ -55,7 +55,7 @@ import { promisify } from "node:util";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { parse as parseYaml } from "yaml";
+import { load as parseYaml } from "js-yaml";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = join(__dirname, "..", "..");

tests/unit/validate-release-green.test.ts

@@ -382,6 +382,16 @@ test("extractCiGates: the REAL ci.yml yields the base-reds that leaked in v3.8.4
   assert.ok(ids.size >= 20, "the real gate set is substantial (>= 20 static gates)");
 });
 
+test("validate-release-green parses workflow YAML via the declared js-yaml dependency", async () => {
+  const fs = await import("node:fs");
+  const src = fs.readFileSync(
+    new URL("../../scripts/quality/validate-release-green.mjs", import.meta.url),
+    "utf8"
+  );
+  assert.match(src, /from ["']js-yaml["']/);
+  assert.doesNotMatch(src, /from ["']yaml["']/);
+});
+
 // ─── Verdict accuracy (review of the #9985 release-green verdict) ────────────
 
 test("firstFailureLine never blames a PASSING line whose test FILE NAME contains 'fail' (#9985)", () => {