ci(release): upgrade npm to >=11.5.1 for OIDC trusted publishing Node 22 ships npm 10.x, which signs OIDC provenance but cannot use OIDC for publish auth (added in npm 11.5.1). The publish PUT went out unauthenticated and npm returned 404. Upgrade npm before publishing in both publish jobs so trusted publishing actually authenticates.