Bootstrap keeps yarn at its pinned version and node at its pinned major (closes #154)

script/bootstrap kept any yarn on PATH, so YARN_VERSION applied
only where none was installed. It now keeps the yarn on PATH only when
yarn --version is exactly YARN_VERSION, and otherwise installs that
version. The node on PATH is used only when it has the pinned major
version, as REPO_POLICIES.md asks, and is at least NODE_MIN_VERSION.
After installing either, bootstrap looks the tool up through PATH
again, stops, naming the path, if that one fails the same check, and
prints the version it uses, as for Go. Every other host script that
runs yarn now goes through the new script/yarn, which uses the first
node on PATH, ~/.local/bin first, when it passes the same test, and
otherwise the pinned node in nvm.

Model: opus-5-5

TODO.md

@@ -21,6 +21,20 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-19: `script/bootstrap` keeps the `yarn` on `PATH` only when
+  `yarn --version` is exactly `YARN_VERSION`, and otherwise installs that
+  version as it did when no yarn was installed
+  ([#154](https://git.eeqj.de/sneak/netwatch/issues/154)); any yarn used to be
+  kept. It uses the `node` on `PATH` only when that node has the major version
+  of `NODE_VERSION`, as `REPO_POLICIES.md` asks, and is at least
+  `NODE_MIN_VERSION`; a node 24 was kept before. After installing node or yarn
+  it looks the tool up through `PATH` again and stops if that one fails the same
+  check, as it does for Go, and it prints the node and yarn versions it uses.
+  Every script that runs yarn on the host, except `script/bootstrap`, which
+  picks its own node and yarn, runs it through the new `script/yarn`. That
+  script puts `~/.local/bin` first on `PATH`, uses the first `node` on that
+  `PATH` when it passes the same test, and otherwise runs yarn under the pinned
+  node in nvm; `make build` ran yarn under whatever node was first on `PATH`
 - 2026-10-19: `bin/entrypoint.sh` has each of its steps in a function, and a
   `main` at the end calls them in order, as the shell section of the code style
   guide asks ([#163](https://git.eeqj.de/sneak/netwatch/issues/163)). It is