ci(npm-release): pin npm upgrade to 11.x, not @latest

[spacedevin]

Summary

Fixes the failing "Publish to npm" job in the v4.0.1 release run — npm publish crashed with:

npm error code MODULE_NOT_FOUND
npm error Cannot find module 'sigstore'

Not a lattish code change. This is the exact same bug already diagnosed and fixed in tishlang/tish's own release workflow (tishlang/tish#480): npm install -g npm@latest now resolves to npm 12.0.0, which is independently broken for publishing — its own package.json lists sigstore in bundleDependencies, but the published tarball doesn't actually contain it. libnpmpublish's publish path requires it unconditionally at module load, so every npm publish crashes — regardless of Node version, and regardless of NPM_CONFIG_PROVENANCE (already false in this workflow).

Fix

Same fix as tishlang/tish#480: bump the runner to Node 24 (more headroom against future engine-floor bumps) but hold npm at 11.x instead of floating to @latest/12.x — 11.18.0 has sigstore bundled correctly, publishes cleanly, and still satisfies this workflow's own >=11.5.1 OIDC trusted-publishing requirement.

Verify

• YAML validated.
• The Node 24 + npm@^11 combination was already validated locally end-to-end (real npm publish --dry-run against a throwaway package, provenance off) while fixing ci(npm-release): pin npm upgrade to 11.x, not @latest tish#480 — identical npm version resolution applies here.
• Once merged, the v4.0.1 release needs release: edited to re-trigger (this workflow's on: includes edited).

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}