fix(yaml): tolerate ansible-vault tags in the shared loader

The cached YAML loader crashed on the !vault tag with a ConstructorError,
so any lint test that walks the tree and parses every .yml (yaml-syntax,
role/group-vars usage, ...) failed as soon as a vault-encrypted inventory
was present. Register a !vault constructor on SafeLoader that loads the
ciphertext as a plain scalar, mirroring the existing !override/!reset
handling.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/lint/filesystem/test_yaml_syntax.py

@@ -23,10 +23,7 @@ class TestYamlSyntax(unittest.TestCase):
                 invalid.append((full, f"Unexpected error: {e}"))
 
         if invalid:
-            msg_lines = [
-                f"{path}: {err.splitlines()[0]}"  # just the first line of the error
-                for path, err in invalid
-            ]
+            msg_lines = [f"{path}: {err.splitlines()[0]}" for path, err in invalid]
             self.fail(
                 "Found invalid YAML in the following files:\n" + "\n".join(msg_lines)
             )

utils/cache/yaml.py

@@ -50,6 +50,13 @@ def _construct_compose_merge_tag(loader, node):
 for _tag in ("!override", "!reset"):
     yaml.SafeLoader.add_constructor(_tag, _construct_compose_merge_tag)
 
+
+def _construct_vault_tag(loader, node):
+    return loader.construct_scalar(node)
+
+
+yaml.SafeLoader.add_constructor("!vault", _construct_vault_tag)
+
 _MISSING = object()
 _CACHE: dict[tuple[str, int, int], list[Any]] = {}