feat(NOJIRA-1234): --ignore-scripts in yarn install

[davidsalvador-tf]

Summary

• Add --ignore-scripts to yarn install in the shared setup action to block postinstall scripts from dependencies
• Run the root postinstall script explicitly as a separate step when detected in package.json
• Add has-postinstall output to the install-check step to avoid duplicate detection

Why

Recent supply chain attacks exploit postinstall scripts in npm/yarn dependencies to exfiltrate credentials and deploy malware on install.

Previously, yarn install --frozen-lockfile ran all postinstall scripts from every dependency. Now:

1. yarn install --frozen-lockfile --ignore-scriptsinstalls dependencies without executing any scripts
2. If the repo has a root postinstall in package.json (e.g., yarn lerna bootstrap), it runs explicitly via yarn run postinstall

This blocks malicious dependency scripts that could run in our CI while preserving the repo's own setup.