ext/yaml SplitDocuments silently drops documents on a malformed "---" separator

SplitDocuments swallows real YAML syntax errors and drops every document already read.

reader.Read() returns an empty buffer both on a clean io.EOF and on a real error (a malformed --- separator like --- oops). The current code checks err == io.EOF || len(b) == 0 before checking err != nil, so a syntax error looks identical to EOF, gets treated as "done", and the function returns nil for err with whatever documents were already collected silently discarded.

pkg/utils/yaml/loadpolicy.go uses SplitDocuments to load policies from multi-document YAML files, so a policy file with one bad separator can drop policies with zero error surfaced.

Repro:

docs, err := yaml.SplitDocuments([]byte("first: true\n---\nsecond: true\n--- oops\nthird: true"))
// err == nil, docs == nil
// expected: err != nil, and at least "first: true" (already fully read before the bad separator) preserved

Have a fix + tests ready, opening a PR for it.