dependencies vs devDependencies

[nottrobin]

Explain what should count as a "devDependency" and what should count as a "dependency" (e.g. in package.json). This matters for Renovate, which can auto-merge devDependencies. And so, it's important that things like "vanilla-framework" aren't in this

So I propose that we explicitly define "dependencies" as anything that will, in any form, make it into the built site. So this would apply to e.g. Vanilla-framework and global-nav, even though those modules themselves aren't used in the production app - instead their contents is used for building the production assets.