fix: replace yarn wrapper with ENV vars in Containerfile

[durandom]

Summary

• Remove custom yarn wrapper script that overwrote corepack's own shim at /usr/local/bin/yarn
• Set COREPACK_HOME=/tmp/corepack — writable under every sandbox policy (fixes COREPACK_HOME points to read-only path at sandbox runtime #2)
• Proxy config (YARN_HTTP(S)_PROXY) is injected at runtime via env files, not baked into the image (related: yarn-proxy.env not sourced — YARN_HTTP_PROXY never set in sandbox #3)

The old approach wrote a bash wrapper that hardcoded COREPACK_HOME and called exec /usr/bin/corepack yarn. This broke because:

1. /usr/local/share/corepack is under /usr which is read-only at runtime
2. The wrapper overwrote corepack's own shim, breaking the standard dispatch chain
3. Env vars set in the wrapper weren't inherited by git hook subprocesses (husky)

Now corepack's own shim is the only yarn on PATH, and everything is configured via ENV / runtime env files.

Test plan

• podman build -t rhdh-fullsend-code:local -f images/code/Containerfile images/code/
• podman run --rm rhdh-fullsend-code:local bash -c 'echo $COREPACK_HOME' → /tmp/corepack
• podman run --rm rhdh-fullsend-code:local yarn --version → version without wrapper
• podman run --rm rhdh-fullsend-code:local bash -c 'file /usr/local/bin/yarn' → corepack shim, not script

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the images/code sandbox image build to rely on ENV configuration rather than a custom yarn wrapper script, aiming to make corepack/yarn work reliably under read-only sandbox filesystem policies and ensure proxy settings are inherited by subprocesses.

Changes:

• Removes the custom /usr/local/bin/yarn wrapper in favor of corepack’s own shim.
• Sets COREPACK_HOME=/tmp/corepack to avoid read-only /usr paths at runtime.
• Bakes Yarn proxy configuration into the image via YARN_HTTP_PROXY / YARN_HTTPS_PROXY.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.