feat(df): add yarn wrapper command behind the firewall proxy

Adds the df yarn wrapper subcommand. The Yarn package manager already landed on main with the env-proxy manager layer; this MR adds the user-facing wrapper and wires it into the dependency-firewall parent command.

The wrapper reuses the NPMMatcher (npm-registry path shape). Routing is pinned per Yarn line by the manager layer already on main: Berry (v2+) ignores the standard HTTP(S)_PROXY variables and honors only YARN_HTTP(S)_PROXY, while Classic (v1) reads the npm_config_* variables. The wrapper sets DisableFlagParsing and forwards every argument verbatim to yarn, resolving the GitLab project from the git remote (so it does not advertise --repo).

Targets main directly — no dependency on the other in-flight ecosystem MRs.

Testing

• go build ./...
• GITLAB_CI=true go test ./internal/commands/df/... — subcommand registered, no --repo advertised, help text has no format error.
• gofmt and golangci-lint clean.
• make gen-docs regenerated the yarn doc page.