YAML generation uses manual string building in compile_gate_step_external

src/compile/filter_ir.rs:

step.push_str(&format!(" name: {}\n", ctx.step_name()));
step.push_str(&format!(" displayName: \"{}\"\n", ctx.display_name()));
These values come from &'static str constants so there's no injection risk today. But the pattern is fragile — a future GateContext variant with a display name containing " or \n would silently produce invalid YAML. Suggest serializing via serde_yaml or at minimum YAML-escaping display names.

Review src/compile/filter_ir.rs and compile_gate_step_external, then compare the current manual YAML construction with the proposed serialization or escaping approach. Done means generated YAML remains valid when names contain quotes or newlines, without changing current output for the existing static names.

Written by the indexing model from the issue text.