fix: allow release lockfile updates

[kvz]

Summary

• allow the release-only changesets install step to update yarn.lock after version bumps
• keep immutable installs everywhere else
• avoid the recurring YN0028 failure on main release runs

Validation

• reproduced the failing path in a disposable worktree with a temporary changeset that bumped @transloadit/node and @transloadit/mcp-server
• ran corepack yarn changeset:version:release successfully and confirmed it updated yarn.lock instead of failing with YN0028