chore: complete mergo migration — port remaining call sites in merge_yaml_functions.go and config_loader.go

[nitrocode]

Summary

PR #2201 replaced the hot-path deep merge implementation with a native Go implementation (deepMergeNative) that is ~3.5× faster. However, the mergo library is still used in two lower-traffic call sites:

• pkg/merge/merge_yaml_functions.go — YAML function merge helpers
• pkg/devcontainer/config_loader.go — devcontainer config loading

Goal

1. Port pkg/merge/merge_yaml_functions.go to use deepMergeNative / MergeWithOptions
2. Port pkg/devcontainer/config_loader.go to use the native merge
3. Remove dario.cat/mergo from go.mod / go.sum entirely (eliminates CVE surface)

Why

Until these sites are ported, a future CVE in mergo could still affect atmos. The dependency should be dropped once no call sites remain.

References

• PR perf(merge): replace mergo pre-copy loop with reflection-free native deep merge (3.5× faster) #2201 — native deep merge hot-path
• Blog post: 3.5× faster deep merge