ci: upgrade npm to latest in publish job for Trusted Publisher OIDC

The npm 10.x that ships with Node 20 doesn't support Trusted Publisher
OIDC auth (requires npm 11.5.1+). Bump to Node 22 and explicitly install
npm@latest before publishing. The previous run produced a misleading
404 from the registry because npm returns 404 (not 403) when OIDC auth
fails on an existing package.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ktamas77

.github/workflows/release.yml

@@ -34,9 +34,10 @@ jobs:
           ref: ${{ needs.release-please.outputs.tag_name }}
       - uses: actions/setup-node@v4
         with:
-          node-version: '20.x'
+          node-version: '22.x'
           registry-url: 'https://registry.npmjs.org'
           cache: npm
+      - run: npm install -g npm@latest
       - run: npm ci
       - run: npm run lint
       - run: npm run typecheck