DENG-215: pin dependency versions (.yarnrc)

[m242]

DENG-215 — dependency supply-chain hardening (Tier 1: config)

This PR adds .yarnrc to enforce dependency policy at install time.

defaultSemverRangePrefix: ""   # pin: 'yarn add' writes exact versions

Note: the 7-day cooldown (npmMinimalAgeGate) needs Yarn ≥ 4.10; this repo is classic(or<4), so this PR pins only. Cooldown will follow once Yarn is upgraded (tracked separately).

• Cooldown applies to new/updated deps; yarn --immutable from the committed lockfile is unaffected.
• A follow-up PR will pin existing floating ranges (10 found) and regenerate the lockfile.

Ref: https://fenderdigital.atlassian.net/browse/DENG-215