chore(ci): ensure npm >=11.5.1 for OIDC trusted publishing

pnpm@10 delegates `pnpm publish` to the npm CLI on PATH, and npm's
OIDC token exchange requires npm >=11.5.1. Node 24's bundled npm only
crossed that threshold around 24.6, so install npm explicitly rather
than depending on whichever Node 24 patch setup-node resolves to.

Author: felixweinberger

.github/workflows/release.yml

@@ -67,6 +67,12 @@ jobs:
             - name: Install dependencies
               run: pnpm install
 
+            # pnpm@10 delegates `pnpm publish` to the npm CLI; OIDC trusted publishing
+            # requires npm >=11.5.1, which Node 24's bundled npm only satisfies from
+            # ~24.6 onward. Pin explicitly so we don't depend on the resolved Node patch.
+            - name: Ensure npm CLI supports OIDC trusted publishing
+              run: npm install -g npm@^11.5.1
+
             - name: Publish to npm
               uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1
               with: