fix: use OSC 8 escape directly instead of terminal-link

terminal-link uses supports-hyperlinks which doesn't detect all
terminals (e.g. Ghostty behind tmux). Use the OSC 8 escape sequence
directly so the URL is always clickable in supported terminals.

pnpm-lock.yaml

@@ -7617,9 +7617,6 @@ importers:
       tempy:
         specifier: 'catalog:'
         version: 3.0.0
-      terminal-link:
-        specifier: 'catalog:'
-        version: 5.0.0
       tinyglobby:
         specifier: 'catalog:'
         version: 0.2.15

releasing/commands/package.json

@@ -76,7 +76,6 @@
     "semver": "catalog:",
     "tar-stream": "catalog:",
     "tempy": "catalog:",
-    "terminal-link": "catalog:",
     "tinyglobby": "catalog:",
     "validate-npm-package-name": "catalog:",
     "write-json-file": "catalog:",

releasing/commands/src/publish/otp.ts

@@ -2,7 +2,6 @@ import { PnpmError } from '@pnpm/error'
 import type { ExportedManifest } from '@pnpm/releasing.exportable-manifest'
 import type { PublishOptions } from 'libnpmpublish'
 import qrcodeTerminal from 'qrcode-terminal'
-import terminalLink from 'terminal-link'
 
 import { SHARED_CONTEXT } from './utils/shared-context.js'
 
@@ -189,7 +188,7 @@ async function webAuthOtp (
 ): Promise<string> {
   const qrCode = generateQrCode(authUrl)
   const sanitizedUrl = sanitizeUrl(authUrl)
-  const displayUrl = sanitizedUrl != null ? terminalLink(sanitizedUrl, sanitizedUrl, { fallback: false }) : authUrl
+  const displayUrl = sanitizedUrl != null ? hyperlinkEscape(sanitizedUrl) : authUrl
   globalInfo(`Authenticate your account at:\n${displayUrl}\n\n${qrCode}`)
   const startTime = Date.now()
   const timeout = 5 * 60 * 1000 // 5 minutes
@@ -301,3 +300,7 @@ function sanitizeUrl (url: string): string | undefined {
     return undefined
   }
 }
+
+function hyperlinkEscape (url: string): string {
+  return `\u001B]8;;${url}\u0007${url}\u001B]8;;\u0007`
+}