chore: address Copilot review round 3 (#2226)

Two factual corrections, both suppressed comments.

- `.claude/skills/local-dev/SKILL.md`: the react/react-dom exception cited
  "19.2.8 today, against the root's 19.2.7" — a skew this PR removes. Dropped
  the version pair; the point being made is about which install resolves the
  pair, and it stands without a number that goes stale on the next bump.
- `verify-dep-lockstep.mjs`: the `devDependencies` bullet claimed all four
  surfaced skews were a devDependency somewhere. `react` is a root runtime
  dependency whose client copies are peer-installed, so it is three of four —
  which is a better illustration of why the union spans fields as well as
  installs, and the bullet now says so.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J86a6vMcA9csPtdsg7ZcCZ
Signed-off-by: cliffhall <cliff@futurescale.com>

.claude/skills/local-dev/SKILL.md

@@ -147,7 +147,7 @@ supposed to rule out.
 **`react` and `react-dom` are the exception, and stay pinned per client.** They
 are a matched pair — `react-dom` reaches into React internals — and `react-dom`
 is still web-declared, so npm resolves it and its React peer together inside
-`clients/web/node_modules` (19.2.8 today, against the root's 19.2.7). Pointing
+`clients/web/node_modules`. Pointing
 `react` at the root while `react-dom` resolves from the client would pair a
 renderer with a React it was not installed against, which is the same split the
 pin exists to prevent, arrived at from the other side. `dedupe` still collapses