Commit the yarn configuration and lock file so the build is reproducible

Problem/Motivation

CI runs corepack enable && yarn install, but this project commits none of the yarn configuration that needs:

• no packageManager field, so corepack has nothing to pin a version to;
• no .yarnrc.yml — CI writes one at runtime with test -f .yarnrc.yml || echo "nodeLinker: node-modules" > .yarnrc.yml;
• no lock file, so every pipeline re-resolves the whole dependency tree.

Two consequences. The build is not reproducible: a transitive release on any day changes what is tested without a line changing here. And the CI file already warns that yarn can fall back to v1 when the version is not pinned, which is the failure this configuration invites.

Sibling projects (ace_editor, admin_audit_trail, canvas_override) all commit packageManager: yarn@4.9.3, .yarnrc.yml and yarn.lock.

Proposed resolution

• Add "packageManager": "yarn@4.9.3" to package.json.
• Commit .yarnrc.yml with nodeLinker: node-modules, so the runtime-generated file is no longer needed.
• Commit yarn.lock.
• Stop ignoring yarn.lock in .gitignore where it is ignored. package-lock.json stays ignored, since this project uses yarn.

Remaining tasks

✅ Pin the package manager
✅ Commit the yarn configuration and lock file
✅ Green pipeline
➖ Review
➖ Release

User interface changes

None. Build tooling only.

API changes

None.

Data model changes

None.