ci: bump npm before publish for OIDC trusted publishing

Node 20 ships with npm 10.x, which predates trusted-publishing
support. The v7.0.0-alpha.0 release hit E404 on PUT because the
publish command fell back to the placeholder NODE_AUTH_TOKEN
setup-node injects when no real token is configured. npm >= 11.5.1
natively understands OIDC trusted publishing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: cubehouse

.github/workflows/release.yml

@@ -19,6 +19,7 @@ jobs:
           node-version: 20
           cache: npm
           registry-url: https://registry.npmjs.org
+      - run: npm install -g npm@latest  # trusted publishing requires npm >= 11.5.1
       - run: npm ci
       - run: npm run lint && npm run typecheck && npm test && npm run build
       - run: npm publish --provenance --access public