chore: consolidate shared toolchain devDependencies into the root package.json #2196

Sub-issue of #2030 — step 2 of two, and depends on step 1 landing first.

Consolidate the shared toolchain devDependencies that every client declares independently.

Scope

Declared in all five manifests: eslint, prettier, typescript, typescript-eslint, globals, @eslint/js.
Declared in four: vitest, @vitest/coverage-v8, @types/node.

Move them to the root manifest and delete the client-side declarations. Verified that npm run from a client directory has the repo root's node_modules/.bin on PATH, so each client's scripts still resolve their binaries from a root-only install.

This also strengthens the exact-pin rule on prettier (#1790): one pin instead of five that can drift independently, so the format gate's verdict cannot shift per client.

Constraints

• These stay devDependencies — nothing here is consumed at runtime, and the published tarball ships only each client's build/.
• Regenerate the lockfiles, and gate with npm run local:gate and npm run pack:verify.
• Re-run npm run verify:dep-lockstep afterward and record the new candidate set in the PR. TOLERATED_SKEW is empty as of chore(scripts): derive dep-lockstep candidates from what enters each tsc program #2029 and should stay empty.
• Confirm each client's validate still resolves prettier, eslint, tsc, and vitest when run from its own directory (the PATH walk-up), and that npm run test:storybook still finds its Playwright browser.
• Confirm the postinstall cascade (scripts/install-clients.mjs) still behaves when a client manifest declares few or no devDependencies.

Done when

• The shared toolchain packages are declared once, at the root.
• npm run local:gate and npm run pack:verify both pass from the root, and each client's own npm run validate passes from its own directory.
• AGENTS.md's dependency-placement section and the root README's matching section describe the consolidated layout, with the .github/copilot-instructions.md mirror updated in the same PR.