ci(release): upgrade npm to >=11.5.1 for OIDC Trusted Publishing

The tag-triggered publish of v3.0.0-alpha.2 failed with E404: Node 20 ships
npm 10.8.2, which can sign provenance via OIDC but cannot AUTHENTICATE the
publish through a Trusted Publisher (that landed in npm 11.5.1). The npm
package's trusted-publisher config was correct; the CI npm was just too old.
Add an `npm install -g npm@latest` step after setup-node so `npm publish`
can use the OIDC token for registry auth.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ynamite

.github/workflows/release.yml

@@ -32,6 +32,12 @@ jobs:
           cache: pnpm
           registry-url: https://registry.npmjs.org
 
+      # OIDC Trusted Publishing (token-less publish + provenance auth) requires
+      # npm >= 11.5.1; Node 20 ships npm 10.8.x, which signs provenance but can't
+      # authenticate the publish (registry returns E404). Upgrade before publish.
+      - name: Upgrade npm for Trusted Publishing
+        run: npm install -g npm@latest
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile