Bootstrap keeps yarn and node only at their pinned versions (closes #154)

script/bootstrap kept any yarn found on PATH, so YARN_VERSION applied
only where none was installed. It now keeps the yarn on PATH only when
yarn --version is exactly YARN_VERSION, and otherwise prepares that
version through corepack. The node on PATH is used only when it has the
pinned major version and is at least NODE_MIN_VERSION, as
REPO_POLICIES.md asks. After installing either, bootstrap looks the tool
up through PATH again, stops naming the path if it is not the pinned
one, and prints the version it uses, as it does for Go. script/fmt and
script/fmt-check use the same node test, and otherwise run prettier
under the pinned node in nvm.

Model: opus-5-5

README.md

@@ -41,11 +41,13 @@ The scripts cover both the frontend and the Go backend, so `make check` fails if
 either one is broken. We provide:
 
 - `script/bootstrap` — install all dependencies (the pinned node via nvm unless
-  one new enough for the frontend's dependencies is installed, yarn via
-  corepack, `yarn install --frozen-lockfile`, Go `GO_VERSION` unless the `go` on
-  `PATH` is exactly that version, and the Go modules), linking what it installs
-  itself into `~/.local/bin`, which has to be on `PATH`. It installs no Go
-  linter and not Docker: `make test` and `make lint` run in Docker
+  the `node` on `PATH` has the pinned major version and is new enough for the
+  frontend's dependencies, yarn `YARN_VERSION` via corepack unless the `yarn` on
+  `PATH` is exactly that version, `yarn install --frozen-lockfile`, Go
+  `GO_VERSION` unless the `go` on `PATH` is exactly that version, and the Go
+  modules), linking what it installs itself into `~/.local/bin`, which has to be
+  on `PATH`. It installs no Go linter and not Docker: `make test` and
+  `make lint` run in Docker
 - `script/setup` — make a fresh clone ready for development: bootstrap plus the
   git pre-commit hook
 - `script/dev` — run the Vite dev server, which proxies `/api` to a locally
@@ -66,7 +68,9 @@ either one is broken. We provide:
   eslint in its `frontend-lint` stage, and golangci-lint over the Go packages
 - `script/fmt` — format all files (writes): prettier over the JavaScript, CSS,
   HTML and Markdown, then gofmt over `cmd/` and `internal/`. It runs on the
-  host, as `script/fmt-check` does, with `~/.local/bin` put on `PATH`
+  host, as `script/fmt-check` does, with `~/.local/bin` put on `PATH`, and runs
+  prettier under the pinned node in nvm when the `node` on `PATH` is not one
+  `script/bootstrap` would use
 - `script/fmt-check` — check formatting (read-only): prettier, then gofmt
 - `script/check` — run test, lint, and fmt-check
 - `script/add-dependency` — add a frontend package, or move one to another