Install ESLint and prettier with yarn 4 through corepack (closes #493)

yarn 1, which the node image ships and which is no longer developed,
printed node's url.parse() deprecation warning during the js-deps
install. package.json now pins yarn 4.18.1 by version and hash in its
packageManager field; the js-deps stage enables it with the node
image's own corepack and runs `yarn install --immutable`. yarn.lock is
regenerated in yarn 4's format from the old lockfile, so every package
keeps the version it had. The new .yarnrc.yml keeps the install in
node_modules/, where the lint and Markdown stages run the tools from.

Model: opus-5-5

README.md

@@ -3062,7 +3062,8 @@ webhooker/
 ├── Dockerfile.browser         # Browser test image built by script/test-browser
 ├── Makefile                   # 13 of 19 targets shim script/; 6 are inline
 ├── go.mod / go.sum
-├── package.json / yarn.lock   # ESLint and prettier, pinned, for the JavaScript lint and Markdown stages
+├── package.json / yarn.lock   # ESLint, prettier and yarn, pinned, for the JavaScript lint and Markdown stages
+├── .yarnrc.yml                # yarn settings: install into node_modules/
 ├── eslint.config.mjs          # ESLint configuration for static/js/
 ├── .prettierrc                # prettier settings for the Markdown
 └── .golangci.yml              # golangci-lint configuration
@@ -3350,13 +3351,17 @@ ESLint never runs on the host either. It lints `static/js/` (not the extracted
 Alpine.js) in the Dockerfile's `js-lint` stage, which `script/lint` builds after
 `Dockerfile.lint` and the image build runs before the builder stage. Its version
 is pinned in `package.json` and every package's hash in `yarn.lock`. The
-`js-deps` stage before it installs ESLint and stays cached until either file
-changes, so only the lint step re-runs and ESLint is not downloaded again.
-`eslint.config.mjs` turns on the rules of the JavaScript styleguide
-`REPO_POLICIES.md` links to that a linter can check: `no-var` and
-`prefer-const`. ESLint prints nothing on a pass, so `script/lint` has no summary
-line to look for; it names the stage once for both `--target` and
-`--no-cache-filter`, and `--target` fails on a name that matches no stage.
+`js-deps` stage before it installs ESLint with `yarn install --immutable`, which
+fails rather than change `yarn.lock`. The yarn it runs is the one the
+`packageManager` field in `package.json` pins by version and hash, which the
+node image's own corepack fetches and checks. The stage stays cached until
+`package.json`, `yarn.lock` or `.yarnrc.yml` changes, so only the lint step
+re-runs and ESLint is not downloaded again. `eslint.config.mjs` turns on the
+rules of the JavaScript styleguide `REPO_POLICIES.md` links to that a linter can
+check: `no-var` and `prefer-const`. ESLint prints nothing on a pass, so
+`script/lint` has no summary line to look for; it names the stage once for both
+`--target` and `--no-cache-filter`, and `--target` fails on a name that matches
+no stage.
 
 prettier formats the Markdown, and it never runs on the host either. It is
 pinned in `package.json` and `yarn.lock` beside ESLint, installed by the same
@@ -3382,8 +3387,9 @@ independently of the compiler's:
    `@source` lines name. `css-check` fails when the committed file differs from
    the generated one, and `make css` writes the generated file out from
    `css-output` (see [Stylesheet](#stylesheet)).
-3. **JavaScript lint stages** (`node:24.21.0-alpine`, with yarn) — `js-deps`
-   installs ESLint and prettier from `yarn.lock` and `js-lint` runs ESLint over
+3. **JavaScript lint stages** (`node:24.21.0-alpine`, with the yarn
+   `package.json` pins, run through the image's corepack) — `js-deps` installs
+   ESLint and prettier from `yarn.lock` and `js-lint` runs ESLint over
    `static/js/` (see [Linting](#linting)).
 4. **Markdown stages** (on `js-deps`) — `markdown-check` runs prettier over the
    Markdown and fails on any file it would change, and `make fmt` writes the