fix(ci): use npm config get prefix for reliable npm dir detection

Author: jdalton

.github/workflows/provenance.yml

@@ -169,8 +169,8 @@ jobs:
       - name: Upgrade npm for trusted publishing
         run: |
           # Avoid npm self-upgrade (corrupts deps mid-install on Node 22).
-          NPM_PREFIX="$(node -p 'process.config.variables.node_prefix')"
-          curl -sL https://registry.npmjs.org/npm/-/npm-11.12.1.tgz | tar xz -C "$NPM_PREFIX/lib/node_modules/npm" --strip-components=1
+          NPM_DIR="$(npm config get prefix)/lib/node_modules/npm"
+          curl -sL https://registry.npmjs.org/npm/-/npm-11.12.1.tgz | tar xz -C "$NPM_DIR" --strip-components=1
           echo "npm version: $(npm --version)"
 
       # Get versions for lock-stepped and independent packages.