fix: declare sibling dependencies as plain versions so published manifests are installable

packages/trilean-sql/package.json

@@ -47,8 +47,8 @@
   },
   "license": "MIT",
   "dependencies": {
-    "trilean": "workspace:^",
-    "trilean-regex": "workspace:^"
+    "trilean": "1.6.1",
+    "trilean-regex": "1.0.2"
   },
   "scripts": {
     "build": "turbo run _build",

packages/trilean/package.json

@@ -49,7 +49,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "trilean-regex": "workspace:^",
+    "trilean-regex": "1.0.2",
     "zod": "^4.5.4"
   },
   "scripts": {

pnpm-workspace.yaml

@@ -1,9 +1,14 @@
 packages:
   - "packages/*"
 
-# pnpm 11 defaults this to false, which means a dependency on a sibling package resolves from the npm registry even when the workspace holds a version satisfying the range. Setting it true links a sibling whenever the declared range is satisfied by the workspace version, and falls back to the registry when it is not. There is one package here today, so nothing exercises it yet -- it is set now so the first sibling added is linked rather than silently downloaded.
+# pnpm 11 defaults this to false, which means a dependency on a sibling package resolves from the npm registry even when the workspace holds a version satisfying the range. Setting it true links a sibling whenever the declared range is satisfied by the workspace version, and falls back to the registry when it is not.
 linkWorkspacePackages: true
 
+# Sibling dependencies are declared as plain exact versions, never with the `workspace:` protocol. The release publishes through `npm publish`, which copies the manifest verbatim and does not understand `workspace:`, so a `workspace:^` range would reach the registry as-is and make the package uninstallable for every consumer. `@exadev/semantic-release-workspace` maintains plain ranges itself, rewriting each dependent's range when the sibling releases, and linkWorkspacePackages above still symlinks the sibling locally whenever the workspace version satisfies it.
+#
+# pnpm's default for this setting is `rolling`, under which `pnpm add <sibling>` writes `workspace:^`. false makes it write the plain version instead, using saveExact below for the exact pin.
+saveWorkspaceProtocol: false
+
 # Every dependency in the tree that ships an install script, and whether it may run. pnpm 11 ignores install scripts unless listed, and fails the install outright while any is neither allowed nor refused -- so an entry is a decision recorded, not merely a permission granted, and `false` is as meaningful an answer as `true`.
 #
 # workerd (the Cloudflare Workers runtime @cloudflare/vitest-pool-workers drives the workers test suite through) and esbuild (its bundler) both need theirs: the script is how each fetches its own platform's binary, and neither runs at all without it.