ci: fix publishing npm requirements

[BrandonStalnaker]

Background

• The release-and-tag job in the Release – Publish workflow failed during the "Update npm" step when running npm install -g npm@latest.
• npm 12.x now requires Node.js ^22.22.2, ^24.15.0, or >=26.0.0, but the workflow installs Node 20, causing an EBADENGINE error and blocking npm publish.
• OIDC trusted publishing only requires npm 11.5.1+, so upgrading to the latest npm is unnecessary for this job.

What Has Changed

• Pin the global npm upgrade in release-publish.yml from npm@latest to npm@11, which is compatible with Node 20 and still meets the trusted publishing requirement.
• Update the inline comment to note that npm 12 requires Node 22+.

Checklist

• I have performed a self-review of my own code.
• I have made corresponding changes to the documentation.
• I have added tests that prove my fix is effective or that my feature works.
• I have tested this locally.

Reference Issue (For employees only. Ignore if you are an outside contributor)

• Closes ticket

[pr-security-agent]

🔒 Security Scan Complete

✅ No security issues detected

Scanned files against 71 rules. · Reviewed commit: d3d7d064ed

📜 Scan history (1 scan)

Commit	Time (UTC)	Status	Findings
d3d7d06	2026-07-23 20:09:13	✅ success	0

ℹ️ About PR Security Agent

This scan was performed by PR Security Agent, an automated security review tool for pull requests. See the User Guide for details on severity levels, feedback reactions, and scan configuration.

Reply @pr-security-agent help for the list of commands you can run on this PR.