feat: resolve workspace: and catalog: protocols when syncing package.json

[antfu]

Summary

When applying a patch directly from a source directory (without --pack), workspace: and catalog: dependency specifiers in the source package.json previously leaked through into the patched package, leaving versions the consumer could not resolve. This PR resolves them inline:

• workspace:* / ^ / ~ / <range> → reuses the version already present in the patched package's existing entry (with workspace:1.2.3 falling back to the literal version when no local entry exists).
• catalog: / catalog:<name> → looked up in the source repo's pnpm-workspace.yaml (catalog for default, catalogs.<name> for named).
• Other unrecognized protocols (npm:, link:, file:, git+ssh:, etc.) keep their literal value but emit a yellow warning naming the protocol.

--pack mode skips catalog lookup since pnpm pack already resolves both protocols. Each resolution emits a dim log line so the user can see what changed. Adds yaml as a dependency for parsing pnpm-workspace.yaml.

Test plan

• Run pnpm typecheck, pnpm lint, pnpm build
• Patch a real package whose source uses workspace: and catalog: deps without --pack; confirm the resulting package.json has resolved versions
• Re-run the same case with --pack and confirm no resolution log lines appear
• Spot-check edge cases: missing pnpm-workspace.yaml, unknown catalog name, unrecognized protocol

🤖 Generated with Claude Code