Bootstrap keeps yarn and node only at their pinned versions (closes #154)

script/bootstrap kept any yarn found on PATH, so YARN_VERSION applied
only where none was installed. It now keeps the yarn on PATH only when
yarn --version is exactly YARN_VERSION, and otherwise prepares that
version through corepack. The node on PATH is used only when it has the
pinned major version and is at least NODE_MIN_VERSION, as
REPO_POLICIES.md asks. After installing either, bootstrap looks the tool
up through PATH again, stops naming the path if it is not the pinned
one, and prints the version it uses, as it does for Go. The other host
scripts that run yarn run it through the new script/yarn, which uses the
same node test with ~/.local/bin first on PATH, and otherwise the pinned
node in nvm.

Model: opus-5-5

script/add-dependency

@@ -23,8 +23,8 @@ main() {
     "" | -* | *[[:space:]]*) usage ;;
     esac
     cd "$ROOT"
-    yarn add --dev "$1"
-    yarn install --frozen-lockfile
+    "$ROOT/script/yarn" add --dev "$1"
+    "$ROOT/script/yarn" install --frozen-lockfile
 }
 
 main "$@"