feat(artifact-registry): add --yarn to login

Description

Yarn 2 and later don't read ~/.npmrc, and glab artifact-registry login had no option for them. On main, --yarn is an unknown flag.

With --yarn, glab exchanges a token and writes it to ~/.yarnrc.yml as an npmRegistries entry for --registry. Yarn 1 users keep using --npm, and the flag help says so.

I checked these points against the source of Yarn 4.18.1, and @phikai confirmed them in the review:

1. glab also writes npmAlwaysAuth: true. Without it, Yarn doesn't send the token for unscoped packages, and the install fails with YN0041 (shown below).
2. The registry key is written as typed, without npm's normalization, because Yarn matches these keys literally. Yarn treats a key with a trailing / or with the scheme in front as the same registry. If such an entry exists, glab refreshes it instead of adding a second one, so the old token can't keep winning.
3. YARN_RC_FILENAME is ignored. Yarn always reads the home file as ~/.yarnrc.yml.
4. Other settings and comments in the file stay, but the file is reindented to two spaces and blank lines may be dropped. The flag help says the formatting can change.

If an npmScopes entry for the same registry has its own npmAuthToken or npmAuthIdent, Yarn sends that one for the scope's packages instead. glab prints a warning for each such scope. It only checks ~/.yarnrc.yml, not a project .yarnrc.yml.

Some files glab can't edit safely: invalid YAML, more than one document, a duplicate npmRegistries key, or YAML anchors on the path. Then it stops with an error and leaves the file as it was.

!4068 and !4078 also change login.go. If one of them merges first, I will rebase.

Related Issues

Resolves #8559

How has this been tested?

I built glab from main and from this branch, with a temporary HOME and config. A small local server answered the token exchange like GitLab does, and acted as an npm registry that only accepts the exchanged token. I ran real Yarn 4.18.1 against it.

Built from main:

$ glab artifact-registry login --yarn --registry http://127.0.0.1:18559/npm --duration 2h
  Unknown flag: --yarn.

Built from this branch:

$ glab artifact-registry login --yarn --registry http://127.0.0.1:18559/npm --duration 2h
✓ Wrote a Yarn auth token for http://127.0.0.1:18559/npm. Point Yarn at that registry with `npmRegistryServer`, at the top level or under `npmScopes`, if you have not already. Token expires at 2026-10-10T18:28:25+03:00.
$ cat ~/.yarnrc.yml
npmRegistries:
  "//127.0.0.1:18559/npm":
    npmAlwaysAuth: true
    npmAuthToken: <token>

Then yarn install with npmRegistryServer: "http://127.0.0.1:18559/npm" finished, and the server saw the token on every request. When I removed the npmAlwaysAuth line, Yarn sent no token:

➤ YN0041: │ tiny-pkg@npm:1.0.0: Invalid authentication (as an anonymous user)

I also tried two existing files:

• A comment, another setting, and a stale "http://127.0.0.1:18559/npm/" entry: glab refreshed that entry and kept the rest, and yarn install worked with the new token.
• Invalid YAML: glab failed with parsing YAML: yaml: line 1: did not find expected ',' or ']', and the file's checksum didn't change.

I added unit tests for a new file, the key spelling, refreshing entries, keeping other content, each refusal, and the scope warning. Checks I ran:

$ go test -count=1 ./internal/commands/artifactregistry/login/
ok  	gitlab.com/gitlab-org/cli/internal/commands/artifactregistry/login	0.644s

gofumpt -l, go vet and golangci-lint on this package printed nothing. The rest runs in the pipeline.

Screenshots (if appropriate):

Not applicable, this is a CLI change.

Implemented with AI assistance; I reviewed and tested the changes.