fix(ci): pin npm to 11.x in release workflow

[wbxl2000]

Related Issue

N/A — unblocks the 0.23.4 release.

Problem

The Release workflow failed to publish @moonshot-ai/kimi-code@0.23.4 to npm (failed run). The pnpm changeset publish step invokes npm publish, which errored with:

MODULE_NOT_FOUND Cannot find module 'sigstore'
Require stack: …/npm/node_modules/libnpmpublish/lib/provenance.js

npm@latest is now 12.0.0, which ships with a packaging bug that drops sigstore (used by npm provenance / OIDC trusted publishing) from the global install — see npm/cli#9722. The "Upgrade npm for Trusted Publishing" step pulls @latest, so it picked up the broken 12.0.0.

What changed

Pin the npm upgrade to the 11.x line (npm install -g npm@11) instead of @latest. npm 11.x (>= 11.5.1) already supports trusted publishing and is unaffected by the 12.0.0 sigstore bug.

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue, or explained the problem above.
• I have added tests that prove my feature works. (N/A — CI workflow change)
• Ran gen-changesets skill, or this PR needs no changeset. (No changeset — workflow change, not bundled)
• Ran gen-docs skill, or this PR needs no doc update. (N/A — workflow change)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9851f08

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR