Docs: Document published dependency constraints

[MaggieCabrera]

What?

Add a repository instruction about the dependency surface of published packages, based on Gutenberg 23.5.0.

Why?

Published runtime files and type declarations must work for npm consumers without relying on this monorepo's hoisting or workspace links. The release discussion also established that a leaked type is sometimes better fixed at the public boundary than by adding a large unrelated dependency.

Evidence:

• Packages: Fix the published dependency surface of npm packages #79095 — the release fix and resolved review discussion involving @manzoorwanijk and @aduth.
• Packages: Declare missing @types/react dependency #78882 — the linked predecessor that exposed the same root-hoisting failure mode.
• Fix missing dependencies for packages #74310 and components: Fix generated TS types referencing unavailable csstype #74655 — earlier examples of missing published dependencies and unavailable generated types.

The PR discussion included a concrete disagreement about adding Storybook as a runtime dependency. That concern was resolved by removing the dependency and fixing the leaked type separately, which is why the instruction preserves both sides of the decision instead of treating every audit finding as a request to add a dependency.

Discussion

This is a release-learning proposal, and the instruction is intentionally open for review. Please challenge the conclusion or suggest a narrower formulation if it would not consistently help future package work. It is also fine to close this PR if the guidance is not useful—the discussion here will help us tune the release-knowledge skill before it becomes part of the release process.

[manzoorwanijk]

Doesn't hurt to have that line there.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: MaggieCabrera <onemaggie@git.wordpress.org>
Co-authored-by: manzoorwanijk <manzoorwanijk@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.