Disable install scripts by default, opt in per package

Yarn 4.18's default is `enableScripts: false`; the version bump kept the
old behaviour by setting it back to true, which re-enables arbitrary
install-time code execution for every package in the tree. Turn it off
again and opt in only where a package actually has to build something.

The list is exactly what Yarn reports as YN0004 with scripts disabled:
@parcel/watcher, @swc/core, and esbuild (keyed by bare name so it covers
both 0.25.12 and 0.27.7). electron and sharp are deliberately absent —
electron ships no lifecycle scripts and sharp resolves prebuilt binaries
through optional platform packages, so neither needs to build.

The workspace's own `postinstall` (electron-builder install-app-deps) is
unaffected: enableScripts only governs dependencies.

Verified with a from-scratch `yarn install --immutable`, the full `yarn
check`, and an `electron-builder --linux dir` pack.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BtCagWFcr4MLHQD4zkPVf5

.yarnrc.yml

@@ -1,6 +1,6 @@
 compressionLevel: mixed
 
-enableScripts: true
+enableScripts: false
 
 nodeLinker: node-modules
 

CONTRIBUTING.md

@@ -177,6 +177,23 @@ Links:
 yarn upgrade-interactive
 ```
 
+Install scripts are disabled by default (`enableScripts: false` in `.yarnrc.yml`), so a
+compromised dependency cannot run code just by being installed. Packages that genuinely need
+to build something at install time are opted in individually under `dependenciesMeta` in
+`package.json`.
+
+If an install prints `YN0004: <package> lists build scripts, but all build scripts have been
+disabled`, decide whether that package really needs to build. If it does, add it:
+
+```json
+"dependenciesMeta": {
+  "<package>": { "built": true }
+}
+```
+
+Ignoring the warning leaves the package unbuilt, which usually surfaces later as a confusing
+runtime failure rather than an install error.
+
 ### i18n strings / Weblate
 
 Run `yarn scan-i18n` to get the newest English strings and push so Weblate gets them.

package.json

@@ -161,6 +161,17 @@
     "yargs-parser": "^22.0.0",
     "zod": "^4.4.3"
   },
+  "dependenciesMeta": {
+    "@parcel/watcher": {
+      "built": true
+    },
+    "@swc/core": {
+      "built": true
+    },
+    "esbuild": {
+      "built": true
+    }
+  },
   "build": {
     "toolsets": {
       "appimage": "1.0.3"

yarn.lock

@@ -9957,6 +9957,13 @@ __metadata:
     yargs: "npm:^18.0.0"
     yargs-parser: "npm:^22.0.0"
     zod: "npm:^4.4.3"
+  dependenciesMeta:
+    "@parcel/watcher":
+      built: true
+    "@swc/core":
+      built: true
+    esbuild:
+      built: true
   languageName: unknown
   linkType: soft