Use yarn, not npm

[peterbe]

npm is weird when you're using package-lock.json. It's counter-intuitive since things like npm i --save somepackage only updates the package-lock.json so it's hard to appreciate which file is the source of truth.