one react-resizable-panels, and honest metadata for the peers

Two dependency problems, and only one of them was real.

── Real: two majors of the same library ──

The root asked for `react-resizable-panels@^4.0.15` (4.6.5) while
`src/workspaces/components` asked for `^2.1.7` (2.1.9). The workspace code targets 2.x,
whose API differs — v4 has no `PanelGroup` export, no `order` prop and no `ref` on
`Panel` — so a file that resolved the root's copy failed to typecheck in a way that
read like a broken extraction.

Nothing imported the root's version. It was vestigial, and removing it collapses the
repository to one: every importer now resolves 2.1.9 and the lockfile has zero v4
entries.

── Not real: the second React ──

Declaring react/react-dom in the package created
`src/workspaces/workspaces/node_modules/react`, which looks exactly like the
duplicate-instance bug that silently breaks hooks. It is not one. Both locations resolve
to the SAME file in bun's store — the local entry is a symlink — which I established by
resolving the specifier from each place instead of reading directory names, having
already reported it as a hazard on the strength of an `ls`.

Declared as optional peers regardless: that is the right metadata for a consumer, and it
stops bun installing peers it does not need to.

Notes corrected to match, since the wrong version of that story was written down.

tsgo clean, package 114/114, full suite 950 pass / 7 fail unchanged, frontend builds.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/workspaces/workspaces/package.json

@@ -9,8 +9,20 @@
     "./core": "./src/core/index.ts",
     "./react": "./src/react/index.ts"
   },
-  "_dependencies_note": "Only the one that had to be pinned. This repository carries TWO versions of react-resizable-panels \u2014 the root asks for ^4.0.15 (4.6.5) and src/workspaces/components for ^2.1.7 (2.1.9) \u2014 and this code was written against 2.x, whose API differs: v4 has no PanelGroup export, no `order` prop and no `ref` on Panel. Inheriting the root resolution produced dozens of type errors that looked like a broken extraction and were a version mismatch. Everything else (react, react-dom, radix, lucide, clsx, tailwind-merge) is deliberately NOT declared while this lives in the monorepo: declaring them at versions that did not match the root produced a second copy of react under this package, which breaks hooks at runtime and is invisible until something renders. Publishing standalone means declaring them all, aligned with the host.",
+  "_dependencies_note": "react and react-dom are peers, marked optional so bun does NOT install them here. Bun installs peer dependencies by default, and a copy of react under this package means TWO React instances \u2014 hooks break at runtime and nothing says so until something renders. Optional peers give a consumer the correct metadata while the monorepo keeps one React. react-resizable-panels is pinned to ^2.1.7 deliberately: this code uses the 2.x API (PanelGroup, `order`, `ref` on Panel), which 4.x removed.",
   "dependencies": {
     "react-resizable-panels": "^2.1.7"
+  },
+  "peerDependencies": {
+    "react": ">=18",
+    "react-dom": ">=18"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    },
+    "react-dom": {
+      "optional": true
+    }
   }
 }