cargo publish only needs to work on your machine. Before publishing, you could replace the symlinks locally, and run cargo publish --allow-dirty if needed.
Forgot to update this in case it's useful to anyone else:
cargo publish --allow-dirty (and package) didn't work, both with/without the --no-verify option too.
I also tried both removing the symlinks, and replacing the symlinks with the directories they pointed at, but all give the same error, e.g.:
$ cargo publish --allow-dirty --no-verify
error: failed to prepare local package for uploading
Caused by:
could not archive source file `foo/bar`
Caused by:
Is a directory (os error 21)
Current plan is to fork the 3rd party repo and replace symlinks, but haven't found the time to do that yet.