Publish an interactive yaml-test-suite conformance matrix

[jskoiz]

Summary

Adds a public, interactive conformance-matrix web page to the hosted guide: all 402 curated yaml-test-suite cases run against saneyaml, serde_yaml, yaml-rust2, and saphyr, with per-case accept/reject results and per-library scores.

• examples/conformance_matrix_html.rs — generator reusing the acceptance methodology of conformance_compare (tree/Value load per library, serde_yaml via its document iterator, third-party calls guarded with catch_unwind). Renders a self-contained HTML page (no external assets, vanilla JS filtering by case id/name/feature, expected outcome, and disagreements), with library versions read from Cargo.lock and case links pinned to the upstream data-branch commit from SOURCE.toml.
• docs/conformance/index.html — committed generated page, so the existing mdBook Pages workflow serves it at /saneyaml/conformance/index.html without building dev-dependencies. mdBook 0.5.3 copies it through verbatim (verified locally).
• docs/conformance.md — reference page with the headline scores and regeneration commands, linked from SUMMARY.md, the docs index, the crate README, and added to the package include list.

Headline numbers (from the generator run)

library	spec accept/reject (400 neutral cases)	duplicate-key policy (2 cases)
saneyaml	400/400 (100%)	2/2
serde_yaml 0.9.34	333/400 (83.25%)	2/2
yaml-rust2 0.11.0	400/400 (100%)	2/2
saphyr 0.0.6	400/400 (100%)	0/2

The 2 tree-error cases are scored separately from the neutral spec axis, matching the framing in conformance_compare.

Also in this branch

• contrib/oss-fuzz/ — ready-to-submit google/oss-fuzz project definition (project.yaml, Dockerfile, build.sh) building all 11 cargo-fuzz targets with debug assertions kept on and shipping each checked-in corpus as the seed corpus, plus submission/verification instructions.
• examples/syq.rs — a minimal yq-style CLI over the lossless ConfigEditor API (get/set/push/rename/rm by JSON Pointer, stdin or file, optional in-place), now referenced from the editing guide as the runnable demo of comment-preserving edits.
• CLAUDE.md — repository guidance for AI assistants.

Verification

• cargo run --locked --example conformance_matrix_html regenerates the committed page byte-identically
• cargo clippy --locked on both new examples with -D warnings, cargo fmt --all --check, cargo package --locked --allow-dirty --list, and cargo test --locked --test conformance_dashboard all pass
• mdbook build (0.5.3, the CI-pinned version) succeeds and includes the matrix page in the book output
• syq exercised end-to-end on a docker-compose-style file: inline comments and anchors survive set/push/rename/rm

[jskoiz]

Review (2026-06-12, while in draft). CI is fully green (mdBook build included). Two concrete fixes worth making before un-drafting, both in examples/conformance_matrix_html.rs:

1. Unescaped interpolation in the score cards (~line 297): the per-library card writes name = library.name and version = library.version into the HTML without escape_html(), unlike the case data which is escaped everywhere else. Versions come from Cargo.lock, so practical risk is low, but the generator should escape every interpolated string uniformly — a hostile/corrupted lockfile shouldn't be able to inject markup into the published page.
2. Unguarded slice of the commit hash (~line 428): &source.data_branch_commit[..12] panics if SOURCE.toml ever carries a hash shorter than 12 chars (or with a multi-byte char in range). source.data_branch_commit.get(..12).unwrap_or(&source.data_branch_commit) or an explicit length check with a clear error would be sturdier.

Things I checked that look good:

• Reproducibility of the committed docs/conformance/index.html: iteration is over BTreeMap/sorted case arrays, no timestamps or environment-dependent values — byte-stable regeneration claim holds up from the code.
• Packaging: the generated index.html is correctly not in the Cargo.toml include list; only docs/conformance.md ships in the crate.
• contrib/oss-fuzz/: referenced fuzz targets all exist under fuzz/fuzz_targets/; project.yaml/build.sh look ready to submit.
• examples/syq.rs: pointer_tokens() implements RFC 6901 correctly (~0/~1 decoding, leading-/ validation), and the in-place write path is read → edit → finish → write with no partial-write hazard.