perf: read yaml through the c loader

Loading the emulator profiles is the most expensive step of every
command here, and all forty call sites used the pure-Python scanner
while libyaml sat unused in the same wheel. One shared yaml_load picks
the C loader when pyyaml ships it: the 375 profiles parse in 0.18s
instead of 1.39s, and verify --platform retroarch drops from 2.17s to
0.73s. The loader class is the same restricted one safe_load uses.

es_bios.xml was parsed straight from the network while install.py
already refused a document declaring entities; both now share one
guard. Scrapers reach it through a single path bootstrap in the
package rather than two ad-hoc ones.

scripts/scraper/mame_hash_scraper.py

@@ -21,6 +21,8 @@ from typing import Any
 
 import yaml
 
+from common import yaml_load
+
 from ._hash_merge import compute_diff, merge_mame_profile
 from .mame_parser import parse_mame_source_tree
 
@@ -165,7 +167,7 @@ def _find_mame_profiles() -> list[Path]:
             continue
         try:
             with open(path, encoding="utf-8") as f:
-                data = yaml.safe_load(f)
+                data = yaml_load(f)
             if not isinstance(data, dict):
                 continue
             upstream = data.get("upstream", "")