chore: address Copilot review round 3 on #2200

Two suppressed comments, both accurate.

- Pin zod, zod/v4 and open to the root in vitest.shared.mts, and add matching
  paths to the three clients/web tsconfigs. The claim they replace — that these
  resolve unambiguously by walk-up — was wrong: both still sit at the top level
  of clients/web/node_modules as transitive copies (zod under
  eslint-plugin-react-hooks, open under Storybook), so an unpinned bare import
  from a web test resolved the client copy while core/ and the SDK packages
  resolved the root's. For open that is only wasteful; for zod it is a schema
  built by one copy and an instanceof check made by the other across the whole
  @modelcontextprotocol/* surface. zod is deduped as well, and zod/v4 gets its
  own entry because first-party code imports both specifiers and pinning one
  would split the package rather than collapse it.
- Update the consumer comments that #2195 falsified. clients/web/vite.config.ts
  (three places) and server/start-vite-dev-server.ts all still said the shared
  aliases resolve pino/hono and friends from clients/web/node_modules; they now
  state the split — react and react-dom from the client install, everything
  root-declared from the repo root.
- local-dev skill: replace the wrong 'resolves unambiguously' list with the
  distinction that actually matters. Deleting a declaration is not the same as
  the package resolving from the root, because chokidar, zod, open and react
  all sit in a client install transitively; check the install, not the manifest.
  ajv, commander and undici carry no pin because no client install has a copy.

npm run local:gate passes from a cold tsc build.

Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/server/start-vite-dev-server.ts

@@ -36,8 +36,9 @@ export async function startViteDevServer(
   // `server.fs.allow` here. Without them, App.tsx's `@inspector/core/*`
   // imports fail to resolve and the page 500s (#1452 smoke test). The aliases
   // and dedupe are factored into `vitest.shared.mts` so both paths stay in
-  // sync — pass the client dir (`root`) so bare-module pins resolve against
-  // `clients/web/node_modules`.
+  // sync — pass the client dir (`root`), which is what the `react` /
+  // `react-dom` pins resolve against. The root-declared packages resolve from
+  // the repo root instead, which that file derives from the same argument.
   const { repoRoot, sharedAliases, sharedDedupe, nodeModulesAliases } =
     vitestSharedPaths(root);
   const inlineConfig: InlineConfig = {