so we can limit the token to that environment

The behaviour should be the same, except the deployer command
is now independent of the CWD.

We also no longer ship deployer in the docker image, but install
it via composer, so it's easier to update.

renovate can't deal with it sadly: https://github.com/renovatebot/renovate/issues/13804

To make sure that the lock file is up to date

We don't want yarn to update the lock file on install which
wouldn't be reproducible.

It's very CI specific

It's confusing that there are two lock files in this repo and two
overlapping workspaces. Ideally everything should be in sync.

lerna complains about this

And remove the custom publish commands

locally yarn would fail because it can't expand the env var because it
is usually missing:

error An unexpected error occurred: "Failed to replace env in config: ${NPM_TOKEN}"