AM-4: gate scenario YAML, retarget on audited source, re-measure

Adopts both remediations from CB-EV-0001 §4 (maintainer decision).

Option A — serde_yaml is now optional behind cb-game-runtime's
`scenarios` feature. The scenario module, the ScenarioGame impl and the
string parsers behind it are cfg-gated; cb-sim opts in explicitly. Both
configurations compile and lint clean under -D warnings.

A trap worth recording: `default-features = false` on a *member*
dependency is silently ignored when the workspace dependency does not
specify it. The first attempt gated nothing while looking correct — the
build succeeded and cargo tree still showed all six YAML crates. Fixed
by setting it on the workspace dependency. This is the positive-control
failure mode in miniature: success was not evidence the change applied.

Retarget — AM-4 now measures third-party source under audit, split by
build configuration, replacing a crate count that was unreachable
without undoing K5/K7 and that does not compare across ecosystems.

Re-measured via the new `make dep-weight`, whose own positive control
refuses to report when any crate's source cannot be located:

  shipped runtime   23 crates   246,250 lines   target <=250,000  met
  dev toolchain     29 crates   317,021 lines   target <=350,000  met
  own source                      3,408 lines

Scenario tooling costs 70,771 lines a shipped game never compiles —
the split the single number was hiding.

Targets are set at current measurement plus headroom, so they bind on
future growth rather than retroactively passing what had failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

crates/cb-game-runtime/Cargo.toml

@@ -9,7 +9,14 @@ cb-kernel.workspace = true
 cb-events.workspace = true
 serde.workspace = true
 serde_json.workspace = true
-serde_yaml.workspace = true
+serde_yaml = { workspace = true, optional = true }
+
+[features]
+# Scenario files are a test-and-tooling concern: a shipped game runtime
+# parses no YAML. Default-on so `cargo test`/`cargo run` behave normally;
+# measure the shipped runtime with --no-default-features (AM-4).
+default = ["scenarios"]
+scenarios = ["dep:serde_yaml"]
 
 [lints]
 workspace = true

crates/cb-game-runtime/src/lib.rs

@@ -1,8 +1,10 @@
 //! cb-game-runtime — round/phase machinery, commit windows, projections,
 //! and the scenario runner (GameKernel §2.5, §3). Game-agnostic.
 
+#[cfg(feature = "scenarios")]
 pub mod scenario;
 
+#[cfg(feature = "scenarios")]
 pub use scenario::{parse_actor, run, CommandStep, RunOutcome, ScenarioFile, ScenarioGame, Setup};
 
 use cb_kernel::PlayerId;