build(dev-deps): move Webpack-dedicated js-yaml-loader to dev deps section

[hainenber]

build(dev-deps): move Webpack-dedicated js-yaml-loader to dev deps section

SUMMARY

js-yaml-loader is only used for building bundled assets by Webpack so it would be pretty alien to have it as runtime dep. This PR is to move it to devDependencies section for clarity of purpose and to reduce vulnerability attack surface.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[bito-code-review]

Bito Automatic Review Skipped - Files Excluded

Bito didn't auto-review this change because all changed files are in the exclusion list for automatic reviews. No action is needed if you didn't intend for the agent to review it. Otherwise, to manually trigger a review, type /review in a comment and save.
You can change the excluded files settings here, or contact your Bito workspace admin at evan@preset.io.

[hainenber]

This is only alphabetic re-ordering of dependencies. It's safe

[codeant-ai-for-open-source]

Sequence Diagram

The PR moves the Webpack-only package js-yaml-loader from runtime dependencies to devDependencies so it is only installed for development/builds. The diagram shows the change flow from manifest update to build-time use and absence at runtime.

sequenceDiagram
    participant Dev as Developer / PR
    participant Repo as package.json & package-lock.json
    participant PM as Package Manager (npm/yarn)
    participant Build as Webpack build
    participant Runtime as Production runtime

    Dev->>Repo: Modify manifests (move js-yaml-loader to devDependencies)
    Repo->>PM: package-lock updated / install metadata marked dev
    PM->>Build: Install devDependencies for CI/local build
    Build->>PM: Use js-yaml-loader during asset bundling
    Note over Runtime,PM: js-yaml-loader not included in production runtime installs
    Runtime-->>Build: Serve bundled assets (no runtime dependency on js-yaml-loader)

Loading

---

Generated by CodeAnt AI

[bito-code-review]

The changes in package.json add several @luma.gl dependencies and remove js-yaml-loader from runtime dependencies. In package-lock.json, js-yaml-loader is moved to devDependencies with related packages marked as dev. This is more than alphabetic reordering and involves functional updates, but appears safe for dependency management.