chore: pin yarn to 4.5.3 via packageManager field

`corepack prepare yarn@stable --activate` (used by CI) resolves to
yarn 4.14.x as of 2026-05, which uses lockfile v9. The in-repo
`yarn.lock` is v8 and hardened mode (enabled for public PRs) refuses
to migrate the lockfile (`YN0028: The lockfile would have been
modified by this install, which is explicitly forbidden`).

Pin the packageManager to 4.5.3 (last release using lockfile v8) so
corepack uses a compatible yarn version in CI and locally. Bump this
when the lockfile is regenerated to v9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: JosephSamirL

package.json

@@ -1,4 +1,5 @@
 {
+  "packageManager": "yarn@4.5.3",
   "scripts": {
     "api:lint": "cd packages/api && yarn lint",
     "bucketing:lint": "cd packages/bucketing && yarn lint",