ut pm-pack: resolve `workspace:` and `catalog:` protocols in emitted manifests

[killagu]

Summary

ut pm-pack emits tarballs whose package.json retains the literal workspace:* and catalog: strings. Anything that later runs npm install against the tarball (publish-to-internal-registry, e2e harnesses, file: overrides) fails immediately with:

npm error code EUNSUPPORTEDPROTOCOL
npm error Unsupported URL Type "catalog:": catalog:

Reproduction

In an utoo workspace using catalog: (and workspace:* for internal deps):

cd packages/foo            # foo has `bar: workspace:*` and `baz: catalog:`
ut pm-pack
tar -xzf foo-*.tgz -C /tmp/x
cat /tmp/x/package/package.json   # still contains "bar": "workspace:*", "baz": "catalog:"

Expected behavior

When packing, rewrite manifest fields the same way pnpm does:

• workspace:* / workspace:^ / workspace:~ → the workspace package's current semver (with caret/tilde semantics)
• catalog: / catalog:<name> → the version pinned in the catalog section of pnpm-workspace.yaml

This is the behavior of pnpm pack and bun pack; without it, monorepos that use the catalog feature cannot publish or run downstream e2e via utoo.

Impact

I'm migrating the eggjs/egg monorepo from pnpm to utoo. The pack step was the only thing that forced us to keep pnpm/action-setup around in CI (PR) — without this fix every consumer of our prebuilt tgz files breaks.

Related

• ut pm-pack -r (recursive pack) is filed separately
• ut pm-pack --pack-destination is filed separately