Consider using `yarn` instead of `npm` to publish JS packages

Most of our projects use (apps and libraries) use yarn for managing NPM dependencies, but when publishing NPM packages doof uses the npm CLI.

This means:

1. Doof ignores yarn.lock, and may install different versions of dependencies than we use locally / on CI
2. Doof's npm install may fail when local / CI yarn install succeeds. This happened recently in course-search-utils because of a difference in how npm vs yarn treat incorrectly met peer dependencies. See https://github.com/mitodl/course-search-utils/pull/61

Neither of these is a big deal. In fact, (1) does not matter at all for pure-JS packages with no build, since transitive dependency versions are controlled by the consumer, not by the library. (In theory, yarn.lock could affect the output of a build step, though.)

But as we update doof, it may be worth considering using yarn for the installation step.

Start by locating doof's package-installation step and read course-search-utils PR 61 for the npm-versus-yarn failure described here. Compare the current release flow with the projects' yarn-based installs; done means the chosen installation approach respects the intended dependency behavior and publishing still succeeds.