docs: correct the dependency-classification claims

Copilot review round 2, four findings, all factual errors in the docs added by
the previous commit:

- `yaml` is in the root `dependencies`, not `devDependencies`, and its only
  importer is `test-servers/src/load-config.ts` — not `core/` or the root
  tooling, as the `vitest.shared.mts` comment claimed.
- The rule as written told a reader to put anything reached through root-owned
  code — `core/` included — in `devDependencies`. That is wrong and would break
  the published package silently: the client builds externalize npm packages, so
  a published install resolves them from the root manifest, where
  devDependencies are absent. Placement (which manifest) and classification
  (which section) are now stated as separate questions, the second following
  from who consumes the package at runtime.

`yaml`'s runtime classification is left alone and called out instead: moving it
changes what ships, which is not a docs change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HDdo1rNRVQnVRRdsqSrvG3

vitest.shared.mts

@@ -83,16 +83,16 @@ export function vitestSharedPaths(clientDir: string) {
       replacement: path.resolve(dirname, "node_modules/@napi-rs/keyring"),
     },
     // `express` and `yaml` resolve from the **repo root**, unlike every pin
-    // above. Both are reached only through root-owned code that has no manifest
-    // of its own — `test-servers/src` imports express, and `core`/the root
-    // tooling uses yaml — so the root is where they are declared and the only
-    // place a client's resolution chain is guaranteed to find them. Pointing
-    // these at `<client>/node_modules` is what broke when the MCP packages moved
-    // to the root (#1970): express was never declared by a client at all, it
-    // arrived in `clients/cli` as a peer of `express-rate-limit` under
-    // `@modelcontextprotocol/server-legacy`, so removing that manifest entry
-    // took express with it and every cli test that spawns a test server failed
-    // to resolve it.
+    // above. Both are reached only through `test-servers/src` — express by the
+    // http/oauth servers, yaml by `load-config.ts` — which is root-owned code
+    // with no manifest of its own, so the root is where they are declared and
+    // the only place a client's resolution chain is guaranteed to find them.
+    // Pointing these at `<client>/node_modules` is what broke when the MCP
+    // packages moved to the root (#1970): express was never declared by a client
+    // at all, it arrived in `clients/cli` as a peer of `express-rate-limit`
+    // under `@modelcontextprotocol/server-legacy`, so removing that manifest
+    // entry took express with it and every cli test that spawns a test server
+    // failed to resolve it.
     {
       find: /^express$/,
       replacement: path.resolve(repoRoot, "node_modules/express"),