chore: pin exact versions for internal dependencies

[sameerank]

Motivation

Ensure consumers always get the tested combination of package versions rather than potentially mismatched versions due to semver ranges.

With caret (^) versions, npm could resolve @datadog/flagging-core@^1.2.1 to a newer version (e.g., 1.3.0) while @datadog/openfeature-browser was built against 1.2.1, potentially causing subtle incompatibilities.

Changes

• Add command.version.exact: true to lerna.json - future yarn release will use exact versions
• Remove caret from existing @datadog/flagging-core dependencies in browser and node-server packages
• Add scripts/internal-deps-validate.sh - validates internal deps use exact versions
• Add CI step to run the validation on every PR

Test instructions

1. Verify CI passes
2. Test that yarn release (dry-run) produces exact versions:

   yarn lerna version --no-push --no-git-tag-version minor
   # Check that package.json files show "1.3.0" not "^1.3.0"
   git checkout -- .

3. Verify the linter catches carets:

   # Temporarily add caret to test
   sed -i '' 's/"@datadog\/flagging-core": "1.2.1"/"@datadog\/flagging-core": "^1.2.1"/' packages/browser/package.json
   ./scripts/internal-deps-validate.sh  # Should fail
   git checkout -- packages/browser/package.json

Checklist

• Updated Documentation
• Tested locally
• Tested on staging
• Added unit tests for this change.
• Added e2e/integration tests for this change.

[dd-oleksii]

👍 oh, I thinks that's why it converted references to carets in the last bump — I forgot --exact 😢

fwiw, I think this is the only change that we actually need. lerna will pin versions on the next release, so it doesn't matter what we currently have in package.json and ci validation is checking irrelevant code.

If you do want to keep validation, I'd put it in pre-release workflow instead, so it checks the source we attempt to release

[dd-oleksii]

also, because we already published a version with caret dependencies, the safest move is to do a major bump, so that released version doesn't start picking up unmatched dependency versions

[sameerank]

lerna will pin versions on the next release, so it doesn't matter what we currently have in package.json

Removed the package.json changes in 5357491 we should see the version get pinned exactly when we run through the release process next time

ci validation is checking irrelevant code

Moved to the pre-release workflow in bc8b6cd

we already published a version with caret dependencies, the safest move is to do a major bump

A major bump makes sense. Safer to establish a clean baseline with exact pinning in 2.0.0