Running either npx create-sst@two project or pnpm create sst@two project (I haven’t tested with yarn) will both create a project whose root package.json states "sst": "^2", but when running pnpm install, all the other package.json files created end up using sst 3.x instead of v2. It appears that the pnpm install does not enforce version 2.
This is the same issue reported here: anomalyco/sst#3893.