[Utoo install] Nested workspace packages can't resolve declared deps — hoisted to anchor only

Describe the bug

When ut install --from pnpm anchors at a non-root workspace (a package.json / pnpm-workspace.yaml that is not the repo root), deps get hoisted into the anchor's node_modules/. Nested workspace packages referenced by that anchor (e.g. ../../packages/foo) cannot resolve those hoisted deps — Node's module resolution walks up from the script location, and the anchor's node_modules/ is sideways, never traversed.

Same root cause manifests twice:

1. Duplicate-package postinstall failure (Cannot find module '@electron/get')
2. Any declared dep of a nested workspace package fails to resolve (25+ TS2307 in our repo)

Reproduction

git clone https://github.com/elrrrrrrr/lobehub -b ut-ci-test
cd lobehub/apps/desktop
ut install --from pnpm     # anchors at apps/desktop (7 workspaces)

Observed:

Error: Cannot find module '@electron/get'
  at packages/electron-client-ipc/node_modules/electron/install.js:3

Layout:

• apps/desktop/node_modules/electron@41.1.0 + apps/desktop/node_modules/@electron/get ✓
• packages/electron-client-ipc/node_modules/electron@39.8.8 (nested due to version conflict)
• packages/electron-client-ipc/node_modules/electron/node_modules/ contains only @types, no @electron/get

Node resolves upward from install.js → never reaches apps/desktop/node_modules/ (sideways).

Expected

For each nested workspace package, its declared deps must be reachable via Node's upward resolution. Three valid layouts:

• A. Nested: packages/<x>/node_modules/<dep>/node_modules/<subdep>
• B. Co-located: packages/<x>/node_modules/<dep>
• C. Symlink to hoisted copy (pnpm's .pnpm/ approach)

utoo currently appears to dedupe to the anchor without checking reachability from nested packages.

Environment

• utoo 1.0.27
• ubuntu-24.04 (GitHub Actions) and macOS — both reproduce
• Node 24.x

Reproduce from apps/desktop with ut install --from pnpm, then inspect the package.json and pnpm-workspace.yaml anchoring there and the nested packages/electron-client-ipc install.js failure. Trace how workspace dependencies are placed and resolved from nested package paths. Done means declared nested dependencies resolve upward and the duplicate-package postinstall no longer fails with Cannot find module '@electron/get'.