fix: wire up Node 24 + setup-node for npm trusted publishing

The previous commit removed .npmrc files and NPM_TOKEN expecting
OIDC-based passwordless auth, but npm trusted publishing requires
Node >=22.14.0, npm >=11.5.1, and actions/setup-node to configure
the registry. Without setup-node the runner had no registry config
at all, causing ENEEDAUTH on every npm publish attempt.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: jbrejner

.github/workflows/release.yml

@@ -144,6 +144,12 @@ jobs:
           go-version-file: '.go-version'
           check-latest: true
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+
       # Use release notes from the tag body when present (set by interactive `make release` or `make release tag=vX.Y.Z` with dist/release_notes.md). Otherwise GoReleaser uses its default changelog.
       # Write to repo root so GoReleaser's --clean (which removes dist/) does not delete the file before it is read.
       - name: Get release notes from tag