fix(deps): add yaml to scripts/package.json (Railway installs from THIS) (#3336)

PR #3333 added `yaml` to the root package.json, but the Railway
seed-bundle-resilience-recovery service builds with rootDirectory
pointing at scripts/ and NIXPACKS auto-detects scripts/package.json
as the install manifest. Root package.json is never visited during
the container build, so yaml stayed missing and the seeder crashed
again at 07:39:26 UTC with the identical ERR_MODULE_NOT_FOUND.

Adding yaml ^2.8.3 (matching the root promotion) to scripts/package.json
so NIXPACKS' `npm install --prefix scripts` lands it in
/app/node_modules/yaml. scripts/shared/swf-manifest-loader.mjs can
then resolve the bare specifier.

Keeping yaml in the root package.json too — it's harmless noise for
local dev + validation bundle (which also imports it via tsx), and
defensive for any future consumer that runs against the root deps.

Future question worth a separate PR: do we want Railway services
pointing at `scripts/` as rootDir, or should we move to a proper
per-service Dockerfile that makes the dep source explicit? The
current state is easy to miss because the Railway dashboard config
is invisible from the repo — second seeder to trip this exact hazard.

scripts/package-lock.json

@@ -19,7 +19,8 @@
         "tsx": "^4.21.0",
         "undici": "^7.0.0",
         "web-push": "^3.6.7",
-        "ws": "^8.18.0"
+        "ws": "^8.18.0",
+        "yaml": "^2.8.3"
       },
       "engines": {
         "node": ">=20"
@@ -4159,6 +4160,21 @@
         "node": ">=0.10.32"
       }
     },
+    "node_modules/yaml": {
+      "version": "2.8.3",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+      "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
+      }
+    },
     "node_modules/zip-stream": {
       "version": "4.1.1",
       "resolved": "https://registry.npmjs.org/zip-stream/-/zip-stream-4.1.1.tgz",

scripts/package.json

@@ -21,7 +21,8 @@
     "tsx": "^4.21.0",
     "undici": "^7.0.0",
     "web-push": "^3.6.7",
-    "ws": "^8.18.0"
+    "ws": "^8.18.0",
+    "yaml": "^2.8.3"
   },
   "engines": {
     "node": ">=20"