ci: drop destructive npm self-upgrade, use bundled npm for publish (#247)

"npm install -g npm@latest" self-upgrades over the bundled npm and
prunes packages it still needs (log shows "removed 71 packages"),
leaving the resulting npm unable to require 'sigstore' during
"npm publish --provenance" (npm/cli#2736, npm/cli#3175).

Node 22.22.3 already bundles npm 10.9.8, and provenance/OIDC id-token
attestation has been supported since npm 9.5. The workflow already
grants id-token: write and publishes with --provenance, so the bundled
npm is sufficient. Removing the self-upgrade step eliminates the whole
class of self-install corruption (promise-retry, sigstore) and the
npm@latest moving-target engine breakage.


Claude-Session: https://claude.ai/code/session_01X4h6iYSAmtDjNuDn3wXaGj

Co-authored-by: Claude <noreply@anthropic.com>

Author: willwashburn

.github/workflows/publish-npm.yml

@@ -214,9 +214,6 @@ jobs:
           name: build-output
           path: .
 
-      - name: Update npm for OIDC support
-        run: npm install -g npm@latest
-
       - name: Dry run check
         if: github.event.inputs.dry_run == 'true'
         working-directory: packages/${{ matrix.package }}
@@ -253,9 +250,6 @@ jobs:
           name: build-output
           path: .
 
-      - name: Update npm for OIDC support
-        run: npm install -g npm@latest
-
       - name: Dry run check
         if: github.event.inputs.dry_run == 'true'
         working-directory: packages/${{ github.event.inputs.package }}