fix: use strict_booleans to avoid YAML 1.1 boolean key parsing

[hardbyte]

Problem

Kustomizer fails to parse Kubernetes CRD resources that use YAML 1.1 boolean words (on, off, yes, no) as map keys:

Error: load resource postgrespolicy.yaml
Caused by: parsing resource: invalid type: boolean `true`, expected a string key at line 1, column 1

This happens because serde-saphyr defaults to YAML 1.1 boolean parsing, where on is parsed as boolean true. When #[serde(flatten)] in the Res struct buffers map entries, the boolean key can't be deserialized into the Map<String, Value> which requires string keys.

Reproduction

Any CRD with on: as a field name triggers this. For example, the pgroles PostgresPolicy CRD uses on in grant definitions:

apiVersion: pgroles.io/v1alpha1
kind: PostgresPolicy
metadata:
  name: test-policy
spec:
  profiles:
    editor:
      grants:
        - on: { type: schema }
          privileges: [USAGE]

Fix

Enable strict_booleans: true in serde_saphyr::Options. This switches to YAML 1.2 behavior where only true/false are booleans. Fields like login: true and inherit: false continue to work correctly, while on/off/yes/no are treated as plain strings.

This also avoids the broader Norway problem class of YAML 1.1 issues.

Test plan

• Verified the fix resolves the PostgresPolicy CRD parsing failure
• cargo test --lib passes (9/9 unit tests)
• Integration tests require kustomize binary and are unrelated to this change

[andyyu2004]

I thought I had test cases for this. Can you make sure to add a regression test. Does kustomize not suffer from the same issue? I'm pretty sure kubernetes uses yaml 1.1

[andyyu2004]

Ok, looks good regarding existing tests. I would like a few more testing these yaml 1.1 vs 1.2 cases to ensure compat with kustomize, then will be happy to approve.

[hardbyte]

Thanks for the quick review, pushed updates:

• const DESER_OPTS — made it a const as suggested
• Regression test added in testdata/regression/yaml11-boolean-key/ — a CRD with on: as a map key alongside login: true and inherit: false.

Re: kustomize compatibility, kustomize (Go) uses sigs.k8s.io/yaml which also uses YAML 1.1 booleans, but it doesn't hit this bug because Go's map[string]interface{} coerces all keys to strings regardless. The issue is specific to Rust's serde #[serde(flatten)] which buffers entries and then fails when a boolean key can't be used as a String map key.

[andyyu2004]

releasing https://github.com/andyyu2004/kustomizer/actions/runs/23874859540