fix(ci): use npm 11 for trusted publishing

[bntvllnt]

Summary

• use npx -y npm@11 publish for trusted publishing instead of trying to self-upgrade the runner's global npm install
• keep OIDC-based publish flow for canary and release jobs while avoiding the npm install -g npm@latest failure and the post-merge ENEEDAUTH fallback
• add a current workflow_dispatch release strategy so the already-bumped version on main can be published without forcing an extra semver bump
• make the release job commit package.json only when a bump actually occurred, then push the tag explicitly

Validation

• npx -y npm@11 publish --dry-run --ignore-scripts
• inspected failed publish runs:
  • https://github.com/vllnt/convex-api-keys/actions/runs/24930747023
  • https://github.com/vllnt/convex-api-keys/actions/runs/24930885645