Provision the Composite-Actions Check's YAML Parser Deterministically #2348

Problem

The repo gate's composite-actions check reads action files with PyYAML, falling back to yq.
validate-task.yml provisions neither, and CI passes only because ubuntu-latest preinstalls yq.
A host with neither gets a named "could not read the action" finding per file.

Options

• Parse through uvx --with pyyaml python, since uv is already a declared host tool and runs the schema half.
• Vendor a minimal reader.
• Declare the dependency.

Done when

The check reads action files on any host that has the declared tools.

Raised by a review finding on #2347.