Published package.json still declares trilean-regex as workspace:^, breaking external installs

[Mearman]

trilean's published npm package.json (confirmed on 1.6.0 and 1.6.1) still has:

"dependencies": {
  "zod": "^4.5.4",
  "trilean-regex": "workspace:^"
}

workspace:^ is a pnpm/npm workspace protocol range that only resolves inside the monorepo that declared it. Once published to npm, any external consumer running pnpm add trilean (or npm/yarn) gets:

Failed to resolve dependency: "trilean-regex@workspace:^" is in the dependencies but no package named "trilean-regex" is present in the workspace

trilean is currently uninstallable by any external project. Root cause is almost certainly that the publish pipeline runs semantic-release/npm publish directly rather than pnpm publish, so the workspace-protocol rewrite pnpm normally performs at publish time never happens.

Fix: ensure the publish step rewrites workspace:^ to trilean-regex's real published semver range before publishing (e.g. pnpm publish instead of npm publish in the release workflow, or an explicit rewrite step), and republish a patch release.

Found while adding trilean as a dependency of wire-mesh-core (ExaDev/wire-mesh#85) -- worked around downstream with a pnpm overrides entry pinning trilean-regex to its own real published version, but that's a workaround, not a fix.