fix: upgrade npm for reactor trusted publish

[irl-dan]

Summary

• Adds a deterministic npm install -g npm@11.5.1 step in the Reactor package publish job before any npm publish --provenance call.
• Extends the publish-workflow verifier so the npm upgrade remains present and ordered before publishing.
• Leaves the rest of the rc.2 publish wiring unchanged: reactor-v* tag trigger, id-token: write, --provenance, and no NPM_TOKEN / _authToken fallback.

Verification

• node --test .github/scripts/verify-reactor-publish-workflow.test.mjs -> 3/3 green
• release verifier node suite -> 35/35 green
• git diff --check -> clean