chore: address Copilot review round 2 (#2226)

All four suppressed comments, none with an inline thread to answer.

- `docs/quality-gate.md`: the second-tier explanation was a paragraph
  *inside* the script table, which breaks the table — the `local:gate` and
  `pack:verify` rows below it would have rendered as pipe-delimited text.
  Folded back into the `verify:dep-lockstep` cell.
- `verify-dep-lockstep.mjs`: the module header and `declaredPackages`'
  summary line both still named two fields after the implementation grew a
  third. Both now name all three, and the header says which field is
  excluded and points at the reason.
- `AGENTS.md`: "Nothing keeps the surviving copies aligned, and nothing
  gates them" contradicted the sentence added later in the same paragraph.
  Split the two claims — nothing aligns them *automatically*, and the guard
  now rejects the drift; the bump is still by hand.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J86a6vMcA9csPtdsg7ZcCZ
Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/verify-dep-lockstep.mjs

@@ -58,9 +58,10 @@
 // `AGENTS.md`'s "one version per install-crossing dependency" rule actually
 // states: does a package that this repo DECLARES somewhere resolve to two
 // different versions across our installs at all? The candidate set is every name
-// in any install's `dependencies`/`devDependencies` (root or client) that more
-// than one install holds a top-level copy of — 17 packages today, against the
-// program tier's much smaller set.
+// in any install's `dependencies`, `devDependencies` or `optionalDependencies`
+// (root or client) that more than one install holds a top-level copy of — 17
+// packages today, against the program tier's much smaller set. `peerDependencies`
+// is the one field excluded, for the reason `declaredPackages` states.
 //
 // The two tiers are complementary and neither subsumes the other:
 //
@@ -275,8 +276,8 @@ export function toleratesSkew(name, holders, tolerated) {
 }
 
 /**
- * Every package name any install declares, across `dependencies` and
- * `devDependencies`.
+ * Every package name any install declares, across `dependencies`,
+ * `devDependencies` and `optionalDependencies`.
  *
  * `manifests` is `[{ dir, manifest }]`. All three fields count because the
  * boundary this tier polices is "does the repo name a package npm will install