Format the markdown with prettier in script/fmt and script/fmt-check (closes #100)

script/fmt and script/fmt-check run prettier 3.8.1 on the markdown after
gofmt, with the same yarn helper and arguments as the copies in
sneak/prompts. prettier is pinned in package.json and yarn.lock;
.prettierrc sets four-space tabs and proseWrap always, and
.prettierignore keeps prettier off REPO_POLICIES.md and vendor/. Plain
script/bootstrap now installs Node and Yarn the way the one in
sneak/prompts does, then prettier; with --cgo it does not, as the
Dockerfile stages that pass it format nothing. The HTML templates stay
out: prettier cannot parse a Go template action inside a tag.

Model: opus-5-5

script/bootstrap

@@ -3,20 +3,33 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes NOTHING is present (not git,
-# make, or go). The linter is never installed on the host: golangci-lint
-# runs only in the lint phase of the Dockerfile (see script/lint).
+# make, or go). Node is used directly if installed; otherwise it is
+# installed at a pinned version via nvm (installing nvm itself first,
+# from a hash-verified release archive, never curl | sh). The linter is
+# never installed on the host: golangci-lint runs only in the lint phase
+# of the Dockerfile (see script/lint).
 #
-#   script/bootstrap         git, make and Go, all the host needs: the
-#                            checks compile pixa in Docker
-#   script/bootstrap --cgo   also a C compiler and the CGO image
-#                            libraries (pkg-config, vips, libheif) for
-#                            the govips bindings, to compile pixa; the
-#                            Dockerfile's test phase and build stage
-#                            run this
+#   script/bootstrap         git, make, Go, and Node, Yarn and the
+#                            prettier in yarn.lock for script/fmt and
+#                            script/fmt-check: all the host needs, as
+#                            the checks compile pixa in Docker
+#   script/bootstrap --cgo   git, make, Go, and a C compiler and the
+#                            CGO image libraries (pkg-config, vips,
+#                            libheif) for the govips bindings instead
+#                            of Node: to compile pixa, in the
+#                            Dockerfile's test phase and build stage,
+#                            which format nothing
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Pinned versions, 2026-07-06
+NODE_VERSION="22.17.0"
+NVM_VERSION="0.40.3"
+# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
+NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
+YARN_VERSION="1.22.22"
+
 PKGMGR=""
 SUDO=""
 
@@ -61,6 +74,69 @@ missing() {
     ! command -v "$1" >/dev/null 2>&1
 }
 
+# verify_sha256 <file> <expected-hash>
+verify_sha256() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        actual="$(sha256sum "$1" | cut -d' ' -f1)"
+    else
+        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
+    fi
+    if [ "$actual" != "$2" ]; then
+        echo "bootstrap: sha256 mismatch for $1" >&2
+        echo "  expected: $2" >&2
+        echo "  actual:   $actual" >&2
+        exit 1
+    fi
+}
+
+# nvm is a bash script; run a command in a bash with nvm loaded
+nvm_sh() {
+    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
+}
+
+ensure_nvm() {
+    [ -s "$HOME/.nvm/nvm.sh" ] && return 0
+    # nvm prerequisites; nvm itself requires bash
+    if missing bash; then pkg_install bash bash bash bash; fi
+    if missing curl; then pkg_install curl curl curl curl; fi
+    if missing git; then pkg_install git git git git; fi
+    tmp="$(mktemp -d)"
+    curl -fsSL -o "$tmp/nvm.tar.gz" \
+        "https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
+    verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
+    mkdir -p "$HOME/.nvm"
+    tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
+    rm -rf "$tmp"
+}
+
+ensure_node() {
+    if ! missing node; then return 0; fi
+    ensure_nvm
+    nvm_sh "nvm install $NODE_VERSION"
+}
+
+ensure_yarn() {
+    if ! missing yarn; then return 0; fi
+    if ! missing corepack; then
+        corepack enable
+        corepack prepare "yarn@$YARN_VERSION" --activate
+    elif [ -s "$HOME/.nvm/nvm.sh" ]; then
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
+            corepack prepare yarn@$YARN_VERSION --activate"
+    else
+        npm install -g "yarn@$YARN_VERSION"
+    fi
+}
+
+install_js_deps() {
+    if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
+            yarn install --frozen-lockfile"
+    else
+        yarn install --frozen-lockfile
+    fi
+}
+
 # CGO dependencies for govips (image processing)
 ensure_cgo_deps() {
     # cgo compiles with gcc on Linux; build-base and build-essential
@@ -98,9 +174,14 @@ main() {
     # Go toolchain
     if missing go; then pkg_install go golang go go; fi
 
-    # CGO image libraries, only where pixa is compiled
+    # CGO image libraries where pixa is compiled; elsewhere Node, Yarn
+    # and prettier
     if [ "$*" = "--cgo" ]; then
         ensure_cgo_deps
+    else
+        ensure_node
+        ensure_yarn
+        install_js_deps
     fi
 
     go mod download