chore(deps): drop a dead declaration and fix a misfiled one

Two manifest corrections found while auditing every declared dependency in
the repo against its actual references.

`packages/runtime` declared `@modelcontextprotocol/sdk` and imports it
nowhere. It went dead in #1661, when the legacy client path migrated to SDK
v2; the live consumer is `packages/mcp`, which declares it correctly as a
devDependency for one test fixture.

This does **not** shrink the packaged app, and the removal should not be
read as a size win: `@openai/agents-core` declares the same package as an
`optionalDependency`, so npm installs it and it stays in the desktop
production closure either way. Measured before and after — 262 packages,
219 MB, unchanged. What the removal buys is an accurate manifest: the
declaration claimed a direct dependency that no longer exists.

`packages/ui` had `react` in `dependencies` and `react-dom` in
`devDependencies` while shipped source imports both — `flushSync` in
`use-message-selection-quote.ts`, reachable from the package entry through
`chat-view.tsx` and emitted into `dist`. Nothing breaks today because
`@maka/ui` is itself vite-bundled into the renderer, but the manifest
disagreed with itself. Also verified this does not pull anything new into
the desktop production closure, since `@maka/ui` is a devDependency there.

Audited and deliberately left alone:

- The nine renderer roots this PR moves to `devDependencies` — that is the
  documented policy, enforced by `maka.rendererBundledDependencies`.
- `linkedom`, which looks test-shaped but is a real production import in
  `packages/runtime/src/local-web-fetch.ts`.
- `@larksuiteoapi/node-sdk` (28 MB) and `@jackwener/opencli` (17 MB), the
  two largest entries in the closure. Both are genuinely imported; removing
  either would drop a feature, which this PR does not do.
- `openai` (19 MB) and `@mixmark-io/domino` (9 MB), which no workspace
  declares — both arrive transitively.
- `@types/node` in the production closure, which `@slack/socket-mode`
  declares as a real dependency. Not ours to fix from here.
- Root `@ai-sdk/provider-utils` and `@astryxdesign/core`, which look
  unreferenced but are a patch target and a resolved peer respectively.

No workspace package is unused: `@maka/eval` has no TypeScript importer but
ships in the CLI release package with its Python harness.

Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

Author: Joob1n