npm@latest resolved to npm@12, which requires Node ^24.15.0. Our .nvmrc
pins Node to v24.2.0, so the runner's post-upgrade npm was incompatible
with its Node and the publish step failed with EBADENGINE.

Track ^11 explicitly so future npm majors don't randomly break releases.
npm 11 already ships the OIDC fixes we originally chased with @latest.