Pin Node.js to 24 in NPM publish workflow

[rustpls]

Motivation

• Publishing to npm was failing with MODULE_NOT_FOUND: Cannot find module 'sigstore' originating from npm's provenance code when using Node 26, so the workflow needs to use a toolchain that doesn't trigger the optional dependency resolution issue.
• Avoid upgrading npm globally in the workflow so the publish step uses the stable npm bundled with the pinned Node.js toolchain.

Description

• Update node-version to 24 in .github/workflows/publish_npm.yml for the publish job.
• Remove the npm install -g npm@latest step so the workflow uses the Node-provided npm instead of forcing a global upgrade.
• Add an inline comment in the workflow explaining that Node 26's bundled npm can fail to resolve the optional sigstore dependency during provenance setup.

Testing

• Ran the inline Python check python - <<'PY' ... PY which verified that node-version: 24 is present and that npm install -g npm@latest has been removed, and it succeeded.
• Ran git diff --check before committing and it returned no issues.

---

Codex Task