Pin npm to 11.x to fix release publish (sigstore bundling bug) (#1237)

Author: nolannbiron

.github/workflows/release.yaml

@@ -29,9 +29,11 @@ jobs:
                   # npm trusted publishing requires npm 11.5.1+ (Node 22.14.0+)
                   node-version: '24'
                   registry-url: 'https://registry.npmjs.org'
-            # Ensure npm 11.5.1 or later is installed
+            # Ensure npm 11.5.1 or later is installed.
+            # Pinned to the 11.x line: npm 12.0.0 ships without the bundled `sigstore`
+            # module, which breaks provenance publishing (npm/cli#9722).
             - name: Update npm
-              run: npm install -g npm@latest
+              run: npm install -g npm@11
             - name: Setup bun
               uses: oven-sh/setup-bun@v2
               with: