ci: Upgrade Yarn to 4.16.0 and update action-npm-publish to v6

[Mrtenz]

Summary

• Upgrades Yarn from 3.2.1 to 4.16.0 (using Corepack, no local release binary)
• Updates .yarnrc.yml to match the module template
• Updates action-npm-publish from v5 to v6 in publish-release.yml
• Makes NPM_TOKEN optional and adds id-token: write permissions to publish-npm job
• Adds id-token: write permission to publish-release job in main.yml

---

Note

Medium Risk
Changes affect the NPM release path (artifact handoff, optional token, OIDC) and CI install/cache behavior; misconfiguration could block releases or produce inconsistent builds, though application runtime code is untouched.

Overview
Standardizes GitHub Actions on MetaMask/action-checkout-and-setup@v3, replacing separate checkout, Node setup, and yarn install steps. CI jobs set is-high-risk-environment: false (with optional node module caching on prepare); release jobs use true. Build/lint/e2e split snap caching into actions/cache/save and actions/cache/restore, and e2e no longer runs a redundant install when restoring dist.

main.yml routes security scanning to MetaMask/action-security-code-scanner reusable workflow v2 (with explicit paths-ignored and renamed secrets), drops the local security-code-scanner.yml, and grants id-token: write on the release caller for OIDC publishing.

publish-release.yml is reordered into build → NPM dry run → NPM publish → GitHub release. A single build uploads dist and .yarn-state.yml as artifacts; downstream jobs restore them instead of rebuilding. MetaMask/action-npm-publish moves to v6; NPM_TOKEN is optional at the workflow level; the publish job adds id-token: write. GitHub release publishing runs only after a successful NPM publish.

Removes the vendored Yarn constraints plugin (.yarn/plugins/@yarnpkg/plugin-constraints.cjs), consistent with Yarn 4 template alignment described in the PR.

^{Reviewed by Cursor Bugbot for commit 6ee30ee. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.