ci(release): pin npm publish job to node 24 + npm ^12

[emal-avala]

Summary

• The v0.27.0 Publish to npm job failed before publishing: the job pins node 20 but upgrades npm via npm install -g npm@latest, and @latest now resolves to npm 12 whose engines require node ≥22.22.2 — EBADENGINE, job dead. Pin node 24 + npm@^12 and pair them explicitly so a future npm major can't silently break the release pipeline again.
• Note for v0.27.0 itself: re-running the failed job re-reads the workflow from the tag commit, so this fix only protects future tags — the 0.27.0 npm package needs a one-off manual npm publish from npm/ (already version-stamped) with a granular token.

Test plan

• Workflow-only change; YAML parses (gh workflow list loads it)
• Engine matrix verified against npm 12's published engines requirement

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.