I was able to workaround by setting the env-var YARN_ENABLE_IMMUTABLE_INSTALLS to false, as suggested here.
This is likely a bug in Yarn Berry. I’ve reported it here: https://github.com/yarnpkg/berry/issues/2948
UPD: I have created a fresh local clone of the repo from GitHub, ran yarn install in it, and it did produce changes in yarn.lock. Committing those changes resolved the CI issue, so disabling YARN_ENABLE_IMMUTABLE_INSTALLS is no longer necessary for me.
The original local repo showed a clean git status, so I still believe it is a bug.
UPD 2: My problem was that one of the Yarn worspaces was checked into git as a git submodule (I have probably created it with a nested .git/ folder and then deleted it). As a result, the workspace content, including a child package.json was not committed into the repo, it only existed in my local repo and not on the remote and CI.
After removing the git submodule and checking the workspace into the repo properly, the YN0028 error stopped happening.