The way it will work is that priority of resolution will be:
<path>.<workspace>.resource/variable.yaml
<path>.resource/variable.yaml
When values will be pulled, they will be under the form:
<path>.resource/variable.yaml
And so it will require manual intervention to make them workspace specific.
The exception will be for secrets, secrets will always be pulled as workspace specific (unless pulled with --plain-secrets) since because of their encryption they are workspace specific