fix(release): preserve pinned registry dependencies during versioning

[shrey150]

Release versioning rewrites evals' published browse: "0.9.5" dependency to the new workspace Browse version, leaving pnpm-lock.yaml unchanged. The next pnpm command fails in CI with ERR_PNPM_OUTDATED_LOCKFILE (failed release).

Set Changesets' bumpVersionsWithWorkspaceProtocolOnly to true so versioning updates explicit workspace dependencies and preserves registry pins. An audit of workspace manifests found evals' Browse pin is the only same-name internal dependency without the workspace protocol. The diff remains one configuration line and evals continue using published Browse 0.9.5.

Alternative: #2963 uses workspace Browse and includes a lean extraction of the required CLI adapter compatibility work from #2838. Use that proposal if evals should exercise the current checkout instead of a fixed published CLI.

E2E Test Matrix

Verified on unchanged head ebb7ddf4c, using pnpm 11.10.0. Compared with #2963 on the same main base, 94457926a.

Command / flow	Observed output	Confidence / sufficiency
CI=true pnpm exec changeset version, then CI=true pnpm exec tsx scripts/release/consolidate-changelogs.ts, then CI=true pnpm install --frozen-lockfile	Passed; workspace Browse bumped from 0.9.6 to 0.9.7; evals retained 0.9.5; eval manifest and lockfile stayed unchanged	Repeated the release sequence that failed in CI; generated release files were discarded
pnpm exec turbo run build --filter=@browserbasehq/stagehand-evals	All 13 build tasks passed	Eval ESM and CLI bundles built; GitHub Build also passed
pnpm exec vitest run --config packages/evals/vitest.config.ts --maxWorkers=4	90 files / 761 tests passed	Run without the devbox OPENAI_API_KEY, matching CI; an initial run inherited it and hit an unrelated Mastra model-routing assertion
Actual generated Claude/Codex Browse wrapper against published 0.9.5: open, fill, click, read title	Browser title became Wrapper passed; cleanup completed with no remaining daemon PID/socket files	Real CLI processes and local Chromium against a synthetic page
Actual native BrowseCliTool.start() against published 0.9.5	Failed with command --json not found before browser startup	Existing adapter defect, also present in main; this config-only fix does not address it. #2963 fixes it and its native browser smoke passes
Changeset validation and config formatting	Passed	Config-only change is valid; GitHub's broader Check job hits an unrelated base README.md formatting issue

Browser tests used local Chromium with an isolated daemon directory and a test-only --no-sandbox launcher for the container. Remote Browserbase sessions, paid model evals, and publishing were not run.

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}