fix(docs): allow webapp-tutorial yarn install to populate empty lockfile in CI

[AztecBot]

Summary

Fixes the docs build failure on merge-train/spartan (CI run 25449092262, log 27a4351a1e5e3568).

Problem

validate-webapp-tutorial in docs/examples/bootstrap.sh intentionally starts each run with an empty yarn.lock, then runs yarn install to populate it from the link: paths it just wrote into package.json. In CI, Yarn 4 auto-enables --immutable when it detects CI=1, so the install fails with YN0028 (frozen lockfile exception) because populating an empty lockfile counts as modifying it.

➤ YN0028: │ The lockfile would have been modified by this install, which is explicitly forbidden.
➤ YN0000: · Failed with errors in 6s 829ms
ERROR: Contract artifact not found at /home/aztec-dev/aztec-packages/docs/target/pod_racing_contract-PodRacing.json

(The "Contract artifact not found" line is a downstream symptom — the script doesn't run with set -e, so after yarn install fails it continues into the artifact check and reports a misleading error.)

Fix

Set YARN_ENABLE_IMMUTABLE_INSTALLS=false for that one yarn install call, since populating the lockfile is the intended behaviour.

Verification

Reproduced locally: CI=true yarn install against the webapp-tutorial fails with YN0028; with YARN_ENABLE_IMMUTABLE_INSTALLS=false it succeeds.

ClaudeBox log: https://claudebox.work/s/a1863de35053b544?run=1