fix(publish): pnpm pack to resolve workspace:* before npm publish

@agentruntimecontrolprotocol/sdk@1.0.1 shipped its internal workspace:*
deps unresolved, so installs failed with EUNSUPPORTEDPROTOCOL. publish.yml
now packs each package with `pnpm pack` (which rewrites workspace:* to the
concrete versions) and publishes the resulting tarball, preserving npm
OIDC provenance. Includes a changeset bumping the sdk meta-package to 1.0.2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Nick Ficano

.changeset/fix-sdk-workspace-publish.md

@@ -0,0 +1,5 @@
+---
+"@agentruntimecontrolprotocol/sdk": patch
+---
+
+fix(publish): pack with `pnpm pack` before `npm publish` so internal `workspace:*` deps resolve to concrete versions in the published manifest. 1.0.1 shipped `workspace:*` unresolved and failed to install with `EUNSUPPORTEDPROTOCOL`.

.github/workflows/publish.yml

@@ -123,7 +123,15 @@ jobs:
               # publishConfig in each package.json carries access=public and
               # provenance=true; --provenance here is the CLI counterpart that
               # activates the OIDC token flow in GitHub Actions.
-              (cd "$dir" && npm publish --provenance --registry=https://registry.npmjs.org)
+              #
+              # Pack with pnpm first: `npm publish` does NOT rewrite the
+              # `workspace:*` protocol in internal deps, so publishing the dir
+              # directly leaks `workspace:*` into the registry manifest and
+              # makes the package uninstallable (EUNSUPPORTEDPROTOCOL). `pnpm
+              # pack` resolves workspace:* to the concrete versions in the
+              # produced tarball; we then publish that tarball.
+              tarball="$(cd "$dir" && pnpm pack --pack-destination "${RUNNER_TEMP:-/tmp}" | tail -n1)"
+              npm publish "$tarball" --provenance --registry=https://registry.npmjs.org
               published=$((published + 1))
             fi
           done < .publish-dirs.txt
@@ -161,7 +169,9 @@ jobs:
               skipped=$((skipped + 1))
             else
               echo "[publish] $name@$local_ver (GitHub Packages has '${gh_ver:-nothing}')"
-              (cd "$dir" && npm publish --registry=https://npm.pkg.github.com)
+              # pnpm pack to resolve workspace:* (see npm step above for why).
+              tarball="$(cd "$dir" && pnpm pack --pack-destination "${RUNNER_TEMP:-/tmp}" | tail -n1)"
+              npm publish "$tarball" --registry=https://npm.pkg.github.com
               published=$((published + 1))
             fi
           done < .publish-dirs.txt