zpm: make render_zar_yaml non-private

It had a few callers and I'm not sure it needs to be private.
zar.yaml: nest group correctly

By mistake, zar['execution']['groups'] was a dict since 4d4e65e2931a.
It is now again a list of dicts as intended.
doc: sync YAML example with real template
Merge pull request #86 from mgeisler/yaml

YAML fixes