Move yaml into runtime dependencies so the published npm installer
works in clean npx environments again. Bump the package to 9.5.1,
add the patch release notes, and keep README metadata aligned with
the release state.
Fixes#445
Include tools/lib in the published npm files whitelist so the npx installer can resolve symlink-safety at runtime. Add a regression test that checks npm pack --dry-run --json for the expected packaged files.
Fixes#315
Co-Authored-By: Claude <noreply@anthropic.com>