v2.71.1: restore npm publish (Node 22 bootstrap fix)

Patch over v2.71.0 to ship the npm packages

v2.71.0 published successfully to crates.io, the GitHub release, and the VS Code marketplace, but the Publish to npm job failed before any tarball reached the registry. The Node 22 runner's bundled npm has a broken dependency tree (Cannot find module 'promise-retry') when asked to install npm@11.x directly, and the v2.71.0 workflow had consolidated to a single-step install. The fix restores the two-step bootstrap (npm@10.9.8 first to repair the tree, then the pinned npm@11.14.1 that holds the OIDC trusted-publishing config). Both installs keep --ignore-scripts so the supply-chain hardening surface stays narrow.

v2.71.1 is functionally equivalent to v2.71.0 on every platform. Users on npm install fallow jump from v2.70.0 straight to v2.71.1; users on cargo install fallow-cli and the VS Code marketplace can stay on v2.71.0 or move to v2.71.1 either way. The full v2.71 changelog (typed fallow/types subpath, the unresolved-catalog-references rule, schema-generated VS Code types) is on the v2.71.0 release page: https://github.com/fallow-rs/fallow/releases/tag/v2.71.0

Upgrade note (carried over from v2.71.0)

The new unresolved-catalog-references rule defaults to error. Workspaces with a broken catalog reference will see fallow check flip red on the bump. To absorb without action:

{
  "rules": {
    "unresolved-catalog-references": "warn"
  }
}

Full Changelog: v2.71.0...v2.71.1