Commit yarn 4 in the tree and install with --immutable (closes #149)

Follows sneak's ruling at
#149 (comment). This
repository now carries yarn 4.18.1 under .yarn/releases. The
distribution's yarn only starts that file, and that file does the work.
yarn.lock is converted once, and script/bootstrap installs with
--immutable instead of stopping on yarn's major version. Node is the
distribution's newest Node package: nodejs-current on Alpine and
nodejs_latest on nix. Every Dockerfile stage that needs yarn also copies
.yarnrc.yml and .yarn/releases/. The policies and both checklists say
so, with the steps for converting and for a new repository.

Model: opus-5-5

prompts/EXISTING_REPO_CHECKLIST.md

@@ -169,12 +169,12 @@ with your task.
           from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.prettierrc`
           and
           `https://git.eeqj.de/sneak/prompts/raw/branch/main/.prettierignore`).
-    - [ ] Any repository with `yarn.lock`: that file is in yarn 4's format. If
-          its second line says `yarn lockfile v1`, convert it with the steps
-          below. Do them in one commit with the re-vendored scripts, because
-          yarn 1 ignores `--immutable` and exits 0 on a tree with no
-          `.yarnrc.yml`. Run them with any distribution's node and yarn, and use
-          `yarnpkg` on Debian and Ubuntu.
+    - [ ] JS: `yarn.lock` is in yarn 4's format. If its second line says
+          `yarn lockfile v1`, convert it with the steps below. Do them in one
+          commit with the re-vendored scripts, because yarn 1 ignores
+          `--immutable` and exits 0 on a tree with no `.yarnrc.yml`. Run them
+          with any distribution's node and yarn, and use `yarnpkg` on Debian and
+          Ubuntu.
         1. Read the version from `yarnPath` in
            `https://git.eeqj.de/sneak/prompts/raw/branch/main/.yarnrc.yml`.
         2. Run `yarn set version <version>`. It writes
@@ -188,7 +188,7 @@ with your task.
            `npmMinimalAgeGate` from `.yarnrc.yml`. The conversion wrote them.
            They allow install scripts, any git repository and packages of any
            age, which yarn otherwise refuses.
-        6. In `package.json`, name any package that must run its install script,
+        6. Name any package that must run its install script in `package.json`,
            as `"dependenciesMeta": { "<name>": { "built": true } }`, and run
            `yarn install` again.
         7. Add `.yarn/*` and `!.yarn/releases` above the secret patterns in
@@ -281,7 +281,7 @@ with your task.
       the distribution's newest Node package, such as `nodejs-current` on Alpine
       3.24
 - [ ] yarn's release file is in git under `.yarn/releases/`, written once by
-      `yarn set version` with an exact version (repositories with `yarn.lock`)
+      `yarn set version` with an exact version
 - [ ] Using `yarn`, not `npm` (JS projects)
 
 # Directory Structure

prompts/NEW_REPO_CHECKLIST.md

@@ -179,11 +179,10 @@ Template files can be fetched from:
           `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and,
           in the same commit, set the lint phase digest to the one named in the
           `.golangci.yml` paragraph of `REPO_POLICIES.md`)
-    - [ ] JS, or any repository that runs prettier through yarn: make the first
-          `yarn.lock` with the steps below. `script/bootstrap` installs no yarn
-          until `yarn.lock` exists, so run them with any distribution's node and
-          yarn, such as Alpine's (`apk add nodejs-current yarn`). Use `yarnpkg`
-          on Debian and Ubuntu.
+    - [ ] JS: make the first `yarn.lock` with the steps below.
+          `script/bootstrap` installs no yarn until `yarn.lock` exists, so run
+          them with any distribution's node and yarn, such as Alpine's
+          (`apk add nodejs-current yarn`). Use `yarnpkg` on Debian and Ubuntu.
         1. Read the version from `yarnPath` in
            `https://git.eeqj.de/sneak/prompts/raw/branch/main/.yarnrc.yml`.
         2. Run `yarn set version <version>`. It writes
@@ -297,7 +296,7 @@ are thin shims calling them. Model scripts:
       the distribution's newest Node package, such as `nodejs-current` on Alpine
       3.24
 - [ ] yarn's release file is in git under `.yarn/releases/`, written once by
-      `yarn set version` with an exact version (repositories with `yarn.lock`)
+      `yarn set version` with an exact version
 - [ ] No unnecessary files in repo root
 - [ ] All dates written as YYYY-MM-DD