perf: read yaml through the c loader

Loading the emulator profiles is the most expensive step of every
command here, and all forty call sites used the pure-Python scanner
while libyaml sat unused in the same wheel. One shared yaml_load picks
the C loader when pyyaml ships it: the 375 profiles parse in 0.18s
instead of 1.39s, and verify --platform retroarch drops from 2.17s to
0.73s. The loader class is the same restricted one safe_load uses.

es_bios.xml was parsed straight from the network while install.py
already refused a document declaring entities; both now share one
guard. Scrapers reach it through a single path bootstrap in the
package rather than two ad-hoc ones.

scripts/scraper/logiqx_parser.py

@@ -15,6 +15,8 @@ from __future__ import annotations
 import xml.etree.ElementTree as ET
 from dataclasses import dataclass, field
 
+from common import parse_untrusted_xml
+
 
 @dataclass
 class LogiqxRom:
@@ -46,10 +48,7 @@ def parse_logiqx(content: str | bytes) -> LogiqxDat:
     rejected: DAT files never define them, and expanding entities
     from untrusted packs opens entity-expansion attacks.
     """
-    haystack = content if isinstance(content, str) else content.decode("utf-8", "replace")
-    if "<!ENTITY" in haystack.upper():
-        raise ValueError("XML entity declarations are not allowed in DAT files")
-    root = ET.fromstring(content)
+    root = parse_untrusted_xml(content, "DAT files")
     dat = LogiqxDat()
 
     header = root.find("header")