chore: add prepublishOnly workspace:* guard

Checks for unresolved workspace:* dependencies before publish.
Changesets resolves these automatically, so normal release flow
passes through. Direct npm publish with workspace deps is blocked.

packages/cli-json-cas/package.json

@@ -7,7 +7,8 @@
     "ucas": "./src/index.ts"
   },
   "scripts": {
-    "test": "bun test"
+    "test": "bun test",
+    "prepublishOnly": "bash ../../scripts/check-workspace-deps.sh"
   },
   "dependencies": {
     "@uncaged/json-cas": "^0.6.0",

packages/json-cas-fs/package.json

@@ -15,7 +15,8 @@
     "src"
   ],
   "scripts": {
-    "test": "bun test"
+    "test": "bun test",
+    "prepublishOnly": "bash ../../scripts/check-workspace-deps.sh"
   },
   "dependencies": {
     "@uncaged/json-cas": "^0.6.0",

packages/json-cas/package.json

@@ -15,7 +15,8 @@
     "src"
   ],
   "scripts": {
-    "test": "bun test"
+    "test": "bun test",
+    "prepublishOnly": "bash ../../scripts/check-workspace-deps.sh"
   },
   "dependencies": {
     "ajv": "^8.20.0",

scripts/check-workspace-deps.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# Prevent publishing packages that still reference workspace:* dependencies
+if grep -q '"workspace:' package.json 2>/dev/null; then
+  echo "❌ Found workspace:* dependencies in package.json — cannot publish directly."
+  echo "   Use 'changeset publish' which resolves workspace protocol automatically."
+  grep '"workspace:' package.json
+  exit 1
+fi