[Tracker] Stable installs

We depend on some `@polkadot/*` packages which we lock to specific versions for development purposes, all is fine.
However `yarn.lock` and `package-lock.json` are ignored in published packages, so user installs may break if a dependency of our dependencies doesn't respect semver.

This problem is common in many package ecosystems, normally the offending package should be yanked.
However `@polkadot/*` moves fast and breaks stuff so we can't rely on that here.

To provide stable installs, current known options are (in order of preference):
- Strongly suggest users use`yarn` + resolutions in their `package.json`
- Publish a `shrinkwrap.json` for `npm` ([risks attached](https://docs.npmjs.com/configuring-npm/shrinkwrap-json))
- Hope `@polkadot` respects semver after doing some upgrade work
- Vendor deps (pls no)