Clarify when the berry pin edits package.json

The npm lock rewriter now also reads the root package.json (#490), so
the contract says the berry pin is the one that edits it, not the only
reader.

Assisted-by: Claude Code:claude-opus-5-5

Author: claude