Node 22.x has a known bug where npm trusted publishing (OIDC) fails
with a misleading E404 on publish. npm docs recommend Node 24 for
trusted publishing. Bumps only the CD publish job.