Adopt scripts-to-rule-them-all: script/ entrypoints, Makefile shims

Dockerfile

@@ -1,13 +1,15 @@
 # node:22-slim (22.x LTS), 2026-02-24
 FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36
 
-RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
-RUN corepack enable && corepack prepare yarn@1.22.22 --activate
-
 WORKDIR /app
 
+# script/bootstrap installs all prerequisites (make via apt here; node
+# is already in the base image, yarn comes via corepack) and runs
+# yarn install --frozen-lockfile. Dependency manifests are copied first
+# so the bootstrap layer is cached until they change.
+COPY script/ script/
 COPY package.json yarn.lock ./
-RUN yarn install --frozen-lockfile
+RUN script/bootstrap
 
 COPY . .