Sync root package-lock.json with package.json

`npm ci` failed at the install step of every CI job:

    npm ERR! `npm ci` can only install packages when your package.json
    npm ERR! and package-lock.json are in sync.
    npm ERR! Missing: yaml@2.9.1 from lock file

The lockfile predates the current dependency tree: tailwindcss 3.4.19
pulls postcss-load-config, which needs yaml@^2, but the lockfile only
carried the top-level yaml@1.10.2.

Regenerated with `npm install --package-lock-only`. The change adds the
missing nested yaml@2.9.1 and drops some stale `peer` metadata flags; no
dependency version or integrity hash changes.

Verified `npm ci` validates under both npm 10 and npm 8.19.4, the version
the lint workflow pins via Node 16.

This unblocks the install step only. The workflows have further problems
that predate this branch, noted on the pull request.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0128YzbhrfGdegUSc9RrARRf

Author: claude