Bootstrap keeps yarn and node only at their pinned versions (closes #154)

script/bootstrap kept any yarn found on PATH, so YARN_VERSION applied
only where none was installed. It now keeps the yarn on PATH only when
yarn --version is exactly YARN_VERSION, and otherwise installs that
version as before. The node on PATH is used only when it has the
pinned major version, as REPO_POLICIES.md asks, and is at least
NODE_MIN_VERSION. After installing either, bootstrap looks the tool up
through PATH again, stops, naming the path, if that one fails the same
check, and prints the version it uses, as it does for Go. Every host
script except bootstrap that runs yarn now runs it through the new
script/yarn, which uses the first node on PATH, with ~/.local/bin
first, when it passes the same test, and otherwise the pinned node in
nvm.

Model: opus-5-5

TODO.md

@@ -21,6 +21,20 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-19: `script/bootstrap` keeps the `yarn` on `PATH` only when
+  `yarn --version` is exactly `YARN_VERSION`, and otherwise installs that
+  version as it did when no yarn was installed
+  ([#154](https://git.eeqj.de/sneak/netwatch/issues/154)); any yarn used to be
+  kept. It uses the `node` on `PATH` only when that node has the major version
+  of `NODE_VERSION`, as `REPO_POLICIES.md` asks, and is at least
+  `NODE_MIN_VERSION`; a node 24 was kept before. After installing node or yarn
+  it looks the tool up through `PATH` again and stops if that one fails the same
+  check, as it does for Go, and it prints the node and yarn versions it uses.
+  Every script that runs yarn on the host, except `script/bootstrap`, which
+  picks its own node and yarn, runs it through the new `script/yarn`. That
+  script puts `~/.local/bin` first on `PATH`, uses the first `node` on that
+  `PATH` when it passes the same test, and otherwise runs yarn under the pinned
+  node in nvm; `make build` ran yarn under whatever node was first on `PATH`
 - 2026-10-19: report file writes no longer overlap
   ([#150](https://git.eeqj.de/sneak/netwatch/issues/150)), so the reports of
   failed writes are written in the order they arrived. Two writes that failed at