Install node, yarn and python from the distribution (closes #146)

Follows sneak's ruling at
#146 (comment). Runtimes
and the installer tools bundled with python come from the distribution,
with no version and no hash. Third-party packages stay pinned by hash.

script/bootstrap drops nvm and corepack. It installs node, yarn and the
node packages only when yarn.lock is in the tree, and stops there when
yarn's major version is not 1. This repository's Dockerfile starts from
Alpine 3.24. The Python example starts from debian:trixie-slim, keeps
pipenv at $HOME/.pipenv on a host and in an image, and sets
PIP_ONLY_BINARY=:all:, so pip downloads no build tools without a hash
check.

Model: opus-5-5

TODO.md

@@ -21,13 +21,6 @@ fmt-check, and commit.
 
 # Completed Steps
 
-- 2026-11-04: An agent whose work is confined to one package may run `go test`
-  directly on that package's suite, or on individual tests in it, while
-  iterating (https://git.eeqj.de/sneak/prompts/issues/51), on sneak's ruling at
-  https://git.eeqj.de/sneak/prompts/issues/51#issuecomment-167600. The full
-  `make check` is still required before every push, and the `Makefile` gains
-  nothing. The rule on Docker now names the lint and test gates, because a run
-  while iterating is not one.
 - 2026-11-04: node, yarn, npm, python, pip and venv now come from the
   distribution with no version and no hash
   (https://git.eeqj.de/sneak/prompts/issues/146), on sneak's ruling at

prompts/REPO_POLICIES.md

@@ -176,12 +176,6 @@ style conventions are in separate documents:
   instead of invoking the underlying tools directly. The Makefile is the single
   source of truth for how these operations are run.
 
-    An agent whose work is confined to one package may run `go test` directly on
-    that package's suite, or on individual tests in it, while iterating. This is
-    the only exception to this rule. `go build`, `go vet` and the linter still
-    go through make targets. A run while iterating is not a gate, so the full
-    `make check` is still required before every push.
-
 - The Makefile is authoritative documentation for how the repo is used. Beyond
   the required targets above, it should have targets for every common operation:
     - running a local development server (`make run`, `make dev`)
@@ -213,9 +207,9 @@ style conventions are in separate documents:
     and the dependency manifests it needs (`package.json` + `yarn.lock`,
     `go.mod` + `go.sum`, etc.) before running it.
 
-- **The lint and test gates run in Docker, as phases of the `Dockerfile`.**
-  There is no separate lint file. `script/lint` and `script/test` each build one
-  phase and nothing else:
+- **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is
+  no separate lint file. `script/lint` and `script/test` each build one phase
+  and nothing else:
 
     ```sh
     docker build --build-arg CACHEBUST="$(date +%s)-$$" \