build: say beside the install why yarn prints the workspaces warning (closes #595)

Yarn 1 warns about every dependency that publishes a workspaces field
without "private": true. eslint 10.8.1 publishes one, and so does
babel-plugin-istanbul 7.0.1, which jest pulls in. No newer release of
either package drops the field. Older releases lack it, but taking one
means downgrading eslint or forcing babel-plugin-istanbul below the
^7.0.1 that jest requires. A one-line comment in script/bootstrap and
in the Dockerfile now names both packages.

Model: opus-5-5

Dockerfile

@@ -10,6 +10,7 @@ WORKDIR /app
 
 COPY script/ script/
 COPY package.json yarn.lock ./
+# yarn warns about the workspaces field in eslint and babel-plugin-istanbul; no newer release drops it.
 RUN script/bootstrap
 
 COPY . .