fix: use yaml.safe_dump for virtual package apm.yml generation

[edenfunf]

Problem

When a virtual file or collection dependency (e.g. a single .agent.md) has a : in its description field, apm install fails with:

Invalid YAML format in .../apm.yml: mapping values are not allowed here
  in "...apm.yml", line 3, column 72

Root cause: download_virtual_file_package and download_collection_package in github_downloader.py generated apm.yml by string interpolation (f"""name: {name}\ndescription: {description}\n"""). Any : in a value produces syntactically invalid YAML.

Concrete example from the issue — swe-subagent frontmatter:

description: 'Senior software engineer subagent for implementation tasks: feature development, debugging, refactoring, and testing.'

After stripping the surrounding quotes and dropping into the f-string, the : after "tasks" is parsed as a YAML mapping separator, causing the error.

Fix

Replace both f-string blocks with yaml_to_str() (backed by yaml.safe_dump), which correctly quotes strings that contain :, #, [, or other YAML special characters.

# Before
apm_yml_content = f"""name: {package_name}
version: 1.0.0
description: {description}
author: {dep_ref.repo_url.split('/')[0]}
"""

# After
apm_yml_data = {
    "name": package_name,
    "version": "1.0.0",
    "description": description,
    "author": dep_ref.repo_url.split('/')[0],
}
apm_yml_content = yaml_to_str(apm_yml_data)

yaml_to_str already exists in apm_cli/utils/yaml_io.py and is the established helper for this purpose throughout the codebase.

Tests

Three new unit tests in TestVirtualFilePackageYamlGeneration:

Test	What it checks
test_yaml_with_colon_in_description	Reproduces the exact swe-subagent failure from #703
test_yaml_with_colon_in_name	Colon in the package name field
test_yaml_without_special_characters_still_valid	Ordinary descriptions still work (regression guard)

Checklist

• Bug reproduced locally before fix
• Fix verified: yaml.safe_load on generated apm.yml succeeds after change
• Both affected code paths fixed (download_virtual_file_package and download_collection_package)
• New tests added and passing
• Existing test suite passes (79 pass, 1 pre-existing unrelated failure)

Closes #703