Use published Cowork SDK

[hexf00]

Summary

• Replace the OpenWork browser app cross-repository @univer/cowork link with the published @univerjs-pro/cowork@0.1.0 package.
• Align browser imports, test imports, and the Univer SDK peer baseline with the c16bf68 release used by Cowork 0.1.0.

Why

• The browser app should consume a reproducible npm tarball instead of depending on a relative path and the source state of another repository.

Issue

• The Node/server distribution surface is tracked by dream-num/univer-cli#724.

Scope

• Cowork browser dependency and imports in apps/app.
• Matching Univer SDK versions and lockfile resolution.

Out of scope

• The OpenWork server continues to consume @univer/cowork/node until the public Node entrypoint is delivered by dream-num/univer-cli#724.
• CLI, skill, daemon, and Electron bundle assembly.

Testing

Ran

• pnpm install --frozen-lockfile --ignore-scripts --registry=https://registry.npmjs.org/
• pnpm --filter @openwork/app typecheck
• pnpm --filter @openwork/app build
• cd apps/app && bun test tests/univer-artifact-header.test.tsx

Result

• Pass: frozen install resolved the published package from the public registry.
• Pass: app TypeScript typecheck.
• Pass: Vite production build with 4,171 modules transformed.
• Pass: 30 tests, 0 failures.

CI status

• Pass locally: dependency installation, typecheck, production bundling, and focused tests.
• Code-related failures: none.
• GitHub currently reports no checks for this branch; the PR remains Draft until repository checks run and pass.

Manual verification

1. Install @univerjs-pro/cowork@0.1.0 and its matching peer baseline from npmjs.
2. Build the app from the published package exports.
3. Confirm that browser production and test imports no longer reference @univer/cowork.

Evidence

• N/A: this changes the dependency source and import boundary without changing UI or interaction behavior. Frozen install, typecheck, production build, and focused tests cover the affected contract.

Risk

• The primary risk is a mismatch between Cowork and the host Univer runtime. The manifest and lockfile pin all direct Univer dependencies to the 1.0.0-insiders.20260710-c16bf68 baseline validated by the Cowork release.

Rollback

• Revert this PR commit to restore the source link and previous SDK baseline.