Support YAML configuration for built-in jobs #26

Context

Provide a declarative way to configure built-in jobs while preserving existing JavaScript/TypeScript configurations during adoption.

Proposed work

Support pullup.yml and pullup.yaml:

jobs:
  codeowners:
    type: codeowners
    input: ["**/CODEOWNERS"]
    output: ".github/CODEOWNERS"

Initially support type: codeowners and reject unsupported job types.

Acceptance criteria

• Preserve existing configurations and public APIs in the release introducing YAML support.
• Reject YAML alongside an existing configuration in the same directory, or both YAML filenames.
• Validate configuration before running jobs, including unsupported versions, unknown fields, duplicate keys/names/outputs, and invalid types.
• Resolve input/output paths relative to the repository root. Prevent unsafe paths, configuration-file overwrites, and outputs escaping the root through symlinks.
• Exclude the active configuration and all declared outputs from input collection.
• YAML and JavaScript built-in jobs produce identical results across sync, check, and sync --dry-run.
• Document the format and migration from existing built-in job configurations.