ci: add npm@latest for OIDC trusted publisher support

Requires npm 11.5.1+ for OIDC token exchange to work properly.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: DumpySquare

.github/workflows/main.yml

@@ -46,6 +46,9 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Update npm for OIDC support
+        run: npm install -g npm@latest
+
       - name: install node deps
         run: npm ci