Adding a package bumps another to a seemingly breaking release

The issue here is that pkg> add TensorKit@0.9 doesn’t add a [compat] entry, so subsequent Pkg operations can do whatever they want. IIRC this may be fixed on Julia 1.8, but in the meantime you can add the corresponding compat entry by hand.