Report malformed YAML as a clean validation error

[KingEmma7]

Fixes #200.

Malformed YAML now produces the existing validation refusal instead of a Python traceback. Catch yaml.YAMLError around the ASTRA validation calls and preserve its native filename and location diagnostic. Both lc status and lc materialize --check report the error on stderr with exit code 1, including with --json.

Regression tests cover malformed specs, universes and externally referenced analyses, scanner/parser/reader errors, and real CLI subprocesses. They also check that validation leaves project files unchanged and unexpected exceptions still propagate. Update the recorded invariant in CLAUDE.md.

Validation:

• 94 focused tests passed; the new regressions fail on untouched upstream.
• Full suite: 1,165 passed, 6 skipped, 1 failed. The crate-profile failure reproduces on untouched upstream with identical diagnostics.
• Ruff passed. Linux-target mypy passed; native macOS mypy has the same existing os.O_PATH error on both versions.
• Real CLI checks preserve dirty-tree precedence and existing schema/semantic error output.