ci(release): bump Node to 24 (bundled npm 11.5+) for OIDC publish

.github/workflows/release.yml

@@ -74,7 +74,11 @@ jobs:
           version: 10
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          # Node 24 ships with npm 11.5+ which speaks Trusted Publishers
+          # OIDC natively. Node 22's bundled npm 10.x cannot do the OIDC
+          # handshake, and in-place self-upgrade (`npm i -g npm@latest`)
+          # consistently breaks with MODULE_NOT_FOUND on the runner image.
+          node-version: 24
           registry-url: "https://registry.npmjs.org"
           # NO `always-auth: true` — that writes a .npmrc `_authToken=${NODE_AUTH_TOKEN}`
           # line which preempts the Trusted Publishers OIDC handshake.
@@ -119,14 +123,8 @@ jobs:
         working-directory: packages/mcp
         run: |
           set -euo pipefail
-          # Install npm@latest into the setup-node prefix (writable; no
-          # sudo). The runner image bundles npm 10.x with Node 22, but
-          # Trusted Publishers OIDC requires npm ≥ 11.5.1. Using `sudo`
-          # would install to /usr/local — outside setup-node's PATH —
-          # leaving the next `npm` call still pointing at 10.x.
-          # `--force` works around a MODULE_NOT_FOUND (promise-retry)
-          # error when npm upgrades itself in-place.
-          npm install -g npm@latest --force
+          # Node 24's bundled npm is ≥11.5 — sufficient for Trusted
+          # Publishers OIDC. No self-upgrade dance required.
           echo "npm $(npm --version) at $(which npm)"
           VERSION=$(node -p "require('./package.json').version")
           # Idempotent: if @leadbay/mcp@$VERSION is already on npm, skip.
@@ -220,7 +218,8 @@ jobs:
           version: 10
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          # Node 24 for bundled npm 11.5+ (Trusted Publishers OIDC).
+          node-version: 24
           registry-url: "https://registry.npmjs.org"
           # See @leadbay/mcp publish-job comment: always-auth writes an
           # _authToken= line that preempts Trusted Publishers OIDC.
@@ -252,8 +251,7 @@ jobs:
         working-directory: packages/leadclaw
         run: |
           set -euo pipefail
-          sudo npm install -g npm@latest --force
-          npm --version
+          echo "npm $(npm --version) at $(which npm)"
           VERSION=$(node -p "require('./package.json').version")
           # Idempotent: if @leadbay/leadclaw@$VERSION is already on npm, skip.
           # Handles the retry-after-ClawHub-failure case without manual intervention.