feat: publish workspace dependency closures

[privatenumber]

Problem

git-publish rejected workspace dependencies, so a package that depended on another package in the same repository could not be installed from Git. Publishing adapter in a core <- broker <- adapter workspace required a manual bundle or left consumers at risk of resolving internal packages from a registry.

Changes

Publishing from a workspace package now prepares its runtime dependency closure, then updates all package branches in one atomic push. Each packed manifest replaces internal runtime dependencies with an immutable, commit-pinned Git URL before its package-specific commit is created.

For example, publishing adapter now prepares core, broker, and adapter before any branch changes. If the remote rejects adapter, Git rejects the whole atomic update, so core and broker do not become partially visible.

The selected package's install specification is printed after a successful push. --fresh records an explicit lease for every package branch before preparation, and recursive publication rejects remotes with multiple push URLs because they cannot provide one transaction.

[github-actions]

📊 Package size report   21%↑

File	Before	After
dist/index.js	71.1 kB	21%↑86.4 kB
package.json	1.5 kB	2%↑1.6 kB
README.md	5.7 kB	30%↑7.4 kB
Total (Includes all files)	79.4 kB	21%↑96.4 kB
Tarball size	29.0 kB	22%↑35.2 kB

Unchanged files

File	Size
LICENSE	1.1 kB

_{🤖 This report was automatically generated by pkg-size-action}