fix(deps): promote yaml from transitive peer to top-level dependency (#3333)

Railway seed-bundle-resilience-recovery crashed at 06:36:18 UTC on
first tick post-#3328 with:

  Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'yaml' imported
  from /app/shared/swf-manifest-loader.mjs

`scripts/shared/swf-manifest-loader.mjs` (landed in #3319) imports
`parse` from `yaml` to read `docs/methodology/swf-classification-manifest.yaml`.
The package is present locally (as a peer of other deps), but Railway
installs production deps only — transitive peers don't land in
/app/node_modules, so the seeder exits 1 before any work.

Adding `yaml ^2.8.3` to `dependencies` so `npm ci` in the container
installs it. Version matches the already-on-disk resolution in
package-lock. No consumer changes needed.

Unblocks the first Sovereign-Wealth Railway run on the resilience-recovery bundle.

package-lock.json

@@ -50,6 +50,7 @@
         "topojson-client": "^3.1.0",
         "uqr": "^0.1.2",
         "ws": "^8.19.0",
+        "yaml": "^2.8.3",
         "youtubei.js": "^16.0.1"
       },
       "devDependencies": {
@@ -24022,7 +24023,6 @@
       "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
       "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
       "license": "ISC",
-      "peer": true,
       "bin": {
         "yaml": "bin.mjs"
       },

package.json

@@ -136,6 +136,7 @@
     "topojson-client": "^3.1.0",
     "uqr": "^0.1.2",
     "ws": "^8.19.0",
+    "yaml": "^2.8.3",
     "youtubei.js": "^16.0.1"
   },
   "overrides": {