fix(ci): Upgrade npm before publish to enable OIDC trusted-publisher path

Node 22 (the setup-node version this workflow pins) ships with npm 10.x.
npm 10 can SIGN provenance via OIDC (the --provenance flag works) but
the actual PUT to publish still authenticates with NODE_AUTH_TOKEN. With
a configured Trusted Publisher on npmjs.com and no NPM_TOKEN secret
provided, the publish PUT runs with an empty token and npm responds
`404 Not Found - PUT ...` -- which is the exact failure mode the v0.9.0
release just hit (publish provenance succeeded, then PUT failed).

Token-less OIDC publish via Trusted Publisher was added in npm 11.5.1.
Add a step that upgrades the global npm to latest before `npm publish`
so the publish step picks up the OIDC-aware code path.

The Node major (22) is intentionally pinned; only npm itself is bumped.

Author: libraz

.github/workflows/release.yml

@@ -104,6 +104,16 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Upgrade npm to a version that supports OIDC publishing
+        # Node 22 ships with npm 10.x. npm 10 can sign provenance via OIDC
+        # but still requires NODE_AUTH_TOKEN to actually publish, so a
+        # workflow with a configured Trusted Publisher (and no NPM_TOKEN
+        # secret) errors with `404 Not Found` on the PUT. Token-less
+        # OIDC publish via Trusted Publisher requires npm >= 11.5.1.
+        run: |
+          npm install -g npm@latest
+          npm --version
+
       - name: Publish to npm
         working-directory: packages/npm
         run: npm publish --access public --provenance