ci: fix npm publish — use Node 24 instead of upgrading npm in place

`npm install -g npm@latest` overwrites the npm shipped in the runner's
toolcache. With recent npm releases this leaves npm's own bundled
dependencies half-replaced, and `npm publish --provenance` then fails
with:

    npm error code MODULE_NOT_FOUND
    npm error Cannot find module 'sigstore'

The step existed because Trusted Publishing (OIDC) requires npm >= 11.5.1
and Node 22 ships npm 10.x. Node 24 already bundles npm 11.x, so the
in-place upgrade is unnecessary. Bump the runtime and drop the step.

This broke between 2026-05-22 (last successful publish) and today, from a
new npm release rather than from any change in this repository. No
package was published by the failed run: npm still serves 1.0.6.

Author: BenGlut

.github/workflows/publish.yml

@@ -41,14 +41,17 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          # Node 24 bundles npm >= 11.5.1, which Trusted Publishing (OIDC) requires.
+          # Do NOT upgrade npm in place with `npm install -g npm@latest`: overwriting the
+          # toolcache npm leaves its bundled dependencies half-replaced, and `npm publish
+          # --provenance` then dies with "Cannot find module 'sigstore'".
+          node-version: '24'
           cache: 'npm'
           # No registry-url: prevents setup-node from writing an _authToken line into
           # .npmrc, which would shadow the OIDC token exchange done by Trusted Publisher.
 
-      - name: Upgrade npm to an OIDC-capable version
-        # Trusted publishing (OIDC) requires npm >= 11.5.1; Node 22 ships with npm 10.x.
-        run: npm install -g npm@latest
+      - name: Show npm version
+        run: npm --version
 
       - name: Install dependencies (skip optional native modules)
         run: npm ci --omit=optional