bootstrap: pinned node via nvm fallback; Dockerfile uses script/bootstrap

Dockerfile

@@ -1,11 +1,15 @@
 # node 22-alpine, 2026-02-22
 FROM node@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34
 
-RUN apk add --no-cache make
-
 WORKDIR /app
-COPY package.json yarn.lock ./
-RUN yarn install --frozen-lockfile
-COPY . .
 
+# script/bootstrap installs all prerequisites (make via apk here; node
+# and yarn are already in the base image, so those steps are skipped).
+# Dependency manifests are copied first so the bootstrap layer is
+# cached until they change.
+COPY script/ script/
+COPY package.json yarn.lock ./
+RUN script/bootstrap
+
+COPY . .
 RUN make check