Document npm optional dependency tree noise

[BigSimmo]

Summary

• Documents the reproducible npm optional dependency tree noise seen on Windows/npm 10.
• Clarifies that npm ci and npm audit --json remain dependency install/security gates.
• Defers treating the specific optional wasm/native npm ls --depth=0 extraneous output as a hard release blocker.

Evidence

• npm ls --depth=0 reports @emnapi/core, @emnapi/runtime, @emnapi/wasi-threads, @napi-rs/wasm-runtime, and @tybys/wasm-util as extraneous.
• npm explain traces them to optional wasm/native dependency paths from @tailwindcss/oxide-wasm32-wasi, @rolldown/binding-wasm32-wasi, and @unrs/resolver-binding-wasm32-wasi.
• package-lock.json contains those optional paths.
• npm audit --json reports zero vulnerabilities.

Verification

Local verification under Node 22:

• npm run format:check passed
• npm audit --json passed with 0 vulnerabilities
• npm run lint passed
• npm run typecheck passed
• npm run test passed: 39 files, 240 tests
• npm run build passed

Risk notes

• Documentation-only change.
• No package or lockfile changes.