docs: point cspNonce at the package the demo imports it from

The global-error demo's comment named @webjsdev/server while the file
imports cspNonce from @webjsdev/core two lines below, which is also the
import every other doc surface recommends. The previous commit rewrote
that sentence and carried the stale package name through.

The prune-note rule cited a header on the generated app/page.ts that does
not exist. That instruction is a comment in the generator, above the
writeFile call, so it never reaches a generated app. The rule now points
only at gallery:clear, which is a claim that holds.

Author: vivek7405

.claude/skills/webjs-scaffold-sync/SKILL.md

@@ -215,9 +215,7 @@ Run the mandatory generate + boot + check verifications in PARALLEL when more th
    spanning several paths (the auth card names its route, its module, its api
    routes and its schema column), or one that depends on another (the
    server-actions card says to prune it with auth). A self-contained demo needs
-   none, since the generated `app/page.ts` header tells the agent to delete the
-   `app/features/<x>` route with its `modules/<x>`, and `npm run gallery:clear`
-   sheds the lot. The scaffold teaches by its comments, and a thin demo is a
+   none, since `npm run gallery:clear` sheds the lot. The scaffold teaches by its comments, and a thin demo is a
    bug.
 
 ## Audit-mode procedure (sweep the scaffold for drift)

packages/cli/templates/gallery/app/global-error.ts

@@ -6,7 +6,7 @@
 // and no boot script. Keep it static HTML with no components or hydration: a
 // last-resort page must not depend on the module system that may have just
 // failed. (Under an opt-in CSP, an inline <script> here needs a nonce via
-// cspNonce() from @webjsdev/server. An inline <style> only needs one if you
+// cspNonce() from @webjsdev/core. An inline <style> only needs one if you
 // tighten style-src, since the default policy allows inline style outright.)
 //
 // Distinct from error.ts (a nested, per-segment boundary that renders a body