*fix #3325

Cursor:

Why is this a bug?
When a user installs gridstack as a dependency (e.g., npm install gridstack), npm automatically executes the library's preinstall, install, and postinstall scripts on the consumer's machine.

Because gridstack.js had "preinstall": "npx only-allow yarn" in its package.json, this script runs during the consumer's installation process. This breaks things in two ways:

It attempts to download only-allow dynamically via npx over the network. For users with a private registry or restricted network (like the Nexus registry returning a 401 error in the issue description), this completely halts the installation.
Even if it could download, it forces the consumer of the library to use yarn for their own app! If they are trying to build an app with npm or pnpm, our preinstall script will throw an error and refuse to let them install our library.
Scripts like only-allow are meant to ensure contributors to the gridstack.js codebase use yarn, but binding it to the preinstall hook in a published library inappropriately enforces this on end-users.

Suggestion / Fix
The only-allow package itself is actually deprecated for exactly these kinds of reasons.

The modern and native way to enforce a package manager for repository contributors is using the "packageManager" field in package.json. Node's built-in corepack reads this and will automatically ensure contributors use the correct package manager. Since gridstack.js already includes "packageManager": "yarn@1.22.22..." in its package.json, the only-allow script is completely redundant anyway.

I have gone ahead and removed the "preinstall": "npx only-allow yarn" script from the package.json.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Cursor changed the meaning when converting to strict mode. manually fixed this logic

strict mode (v13.0.0) fails columnWidth without .breakpoints