[aryanjasala]

What this PR does

Picks up Aditya's non-blocking notes on #77, which merged without them so the 1.0.1 release could go out tonight. Docs and comments only, no behaviour change.

Changes

• webpack.blocks.config.js and docs/hmr.md said the wrapper exists because webpack-dev-server v5, pinned through overrides, rejects the object-form proxy wp-scripts emitted. Since fix(deps): update @wordpress/scripts to 37 and refresh stale npm overrides #77 that pin is gone and wp-scripts 37 runs webpack-dev-server 6 with an array-form proxy. The wrapper still removes it, for a different reason: the /build proxy target is hardcoded to localhost:8887 (the theme's default port), so with this plugin's 8886 or any custom BLOCKS_DEV_SERVER_PORT it points at another server. The comments and docs now say that.
• docs/internal/maintenance.md gets a Dependency updates row for @wordpress/theme 4.0.0: why it is a direct dev dependency (the @wordpress/stylelint-config peer that legacy-peer-deps does not install), and how to bump it.

How I verified

• Checked @wordpress/scripts 37.0.0's config/webpack.config.js: the dev server's proxy is [ { context: [ '/build' ], target: 'http://localhost:8887', ... } ].
• package-lock.json on main resolves webpack-dev-server 6.1.0, with no override.
• npm view @wordpress/stylelint-config@27 peerDependencies lists @wordpress/theme as ^3.0.0 || ^4.0.0.
• node --check webpack.blocks.config.js; only comments changed in it.

Reviewer notes

The split @wordpress/theme versions in the lockfile and the older scaffold requirements are a separate compatibility check; tracked in #79.