Commit yarn 4 in the tree and install with --immutable (closes #149)

Follows sneak's ruling at
#149 (comment). This
repository now carries yarn 4.18.1 under .yarn/releases, and whichever
yarn the distribution packages hands the work to it. yarn.lock is
converted once, and script/bootstrap installs with --immutable instead
of stopping on yarn's major version. Node on Alpine is nodejs-current.
Every Dockerfile stage that needs yarn also copies .yarnrc.yml and
.yarn/releases/. The policies and both checklists say so, with the
steps for converting and for a new repository.

Model: opus-5-5

.gitignore

@@ -19,6 +19,8 @@ Thumbs.db
 
 # Node
 node_modules/
+.yarn/*
+!.yarn/releases
 
 # Secrets. Unanchored like every entry above, so each matches at every
 # depth. Matching is case-sensitive on Linux, so names use character