Untrack yarn.lock — npm/package-lock.json governs the fleet

The fleet tooling is npm-only (setup-linux.sh installs with npm,
update-check.mjs triggers installs off package-lock.json), so the
committed yarn.lock did nothing for any VPS — but yarn regenerating it
locally dirtied working trees and blocked git pull on machines where
yarn had ever been run. Now gitignored: yarn dev still works wherever
someone wants it, with a local lockfile git never sees.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitignore

@@ -77,3 +77,5 @@ deploy/.publish.lock
 .data/
 # per-device instance registry (add-instance.sh)
 scripts/instances.json
+# yarn is dev-convenience only; npm/package-lock.json governs the fleet
+yarn.lock