If you use any:: that is better in general, because then pak does not try to install the latest version of these extra packages, and their soft dependencies also won't be installed.
Unfortunately you cannot specify this for lorenzwalthert/touchstone so all dependencies of this package will be installed, and it requires some packages, e.g. testthat 3.0.0, that are not available in the RSPM repo.
If you look at the lock file, you'll see that some packages are coming from CRAN, still.
A better option for now, until you can tell pak not to install the soft dependencies of the extra GH package, is to remove lorenzwalthert/touchstone from the extra packages, and install it manually, after the setup-r-dependencies step, by calling
pak::pkg_install("lorenzwalthert/touchstone@main")
I think remotes will just use install.packages() for the dependencies, which always chooses the newest version, so more packages will come from CRAN.