move SDK into symlink, drop force from installation path

[metapileks]

Tests currently import @metadaoproject/programs from a copy of sdk/ that yarn makes at install time.
The CI action caches node_modules under a constant key, and when the root lockfile is unchanged yarn reports Already up-to-date and keeps the stale copy, so SDK changes are invisible to CI until the cache is cleared/evicted.
Switching the dependency to link:./sdk makes the entry a symlink, so tests always see the current sdk/dist, which CI and rebuild.sh already rebuild on every run. Drops the yarn install --force workaround from rebuild.sh and the docs.

Greptile Summary

This PR changes the root SDK dependency from a copied local package to a Yarn-managed symlink so consumers see the current SDK build, removes the forced root reinstall, and updates development documentation accordingly.

• Uses link:./sdk for @metadaoproject/programs.
• Regenerates the Yarn lock entry for the linked package.
• Keeps SDK dependency installation and compilation in rebuild.sh.
• Replaces manual setup and linking instructions with the consolidated rebuild workflow.

Confidence Score: 5/5

The PR appears safe to merge; the linked SDK is built and supplied with its own dependencies by the supported setup and CI workflows.

No actionable failure remains: the lockfile matches Yarn 1 semantics, SDK dependencies are installed within sdk, and build-local generates the distribution files consumed through the symlink.

Important Files Changed

Filename	Overview
package.json	Switches the local SDK dependency to Yarn's symlink-based link: protocol.
yarn.lock	Records the expected Yarn 1 lockfile representation for the linked SDK.
rebuild.sh	Retains ordered program and SDK builds while replacing the forced root install with a normal install.
README.md	Consolidates development setup around rebuild.sh and documents symlink-based SDK resolution.
scripts/README.md	Removes manual Yarn linking and directs script users to the repository rebuild workflow.

_{Reviews (1): Last reviewed commit: "move SDK into symlink, drop force from i..." | Re-trigger Greptile}

Context used:

• Knowledge Base — TypeScript SDK
• Knowledge Base — Roll back yarn.lock changes that broke CI

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​metadaoproject/​programs@​0.1.1-alpha.0 ⏵ 0.0.0	N/A	N/A	N/A	N/A	N/A

View full report

[github-actions]

Repository Guard

• Cargo.lock: pass
• yarn.lock (sdk): pass
• yarn.lock (root): pass
• Repo guard: pass

Repository Guard

Cargo dependency pinning

• Status: pass
• Every programs/*/Cargo.toml dep uses =x.y.z, a path = .. workspace ref, or a git dep with a 40-char rev.

Cross-program Anchor/Solana version consistency

• Status: pass
• anchor-lang and anchor-spl are pinned to the version declared in repo-guard.toml across every program.

solana-program crate pin

• Status: pass
• Every solana-program = "=X" declaration is =1.17.14 (locked to match Cargo.lock).

Anchor.toml solana_version

• Status: pass
• Anchor.toml declares solana_version = "1.17.34" (local-dev install for anchor test).

Crate minimum age

• Status: pass
• All Cargo deps changed by this PR are at least 14 days old on crates.io.

Yarn package.json pinning

• Status: pass
• All package.json deps use exact versions (no ^, ~, ranges).

npm minimum age

• Status: pass
• All npm deps changed by this PR are at least 14 days old.

Workflow toolchain consistency

• Status: pass
• Every workflow declares anchor-version: 0.29.0.
• Per-file solana-cli-version values match [toolchain.workflow_solana_cli] in repo-guard.toml.

GitHub Action SHA pinning

• Status: pass
• Every third-party action is pinned to a SHA in [actions.sha_allowlist].

Sensitive program / config changes

• Status: warn
• Review hint only (CODEOWNERS is the merge gate). Lines below match heuristics for security-sensitive changes:
• High-sensitivity files touched: .github/workflows/repo-guard.yml

Overall status: pass

Lockfile freshness (Cargo.lock + yarn.lock) is checked by the workflow directly and cannot be bypassed. The sensitive-diff section is a review hint - CODEOWNERS handles the actual merge gate.