fix(release): pin OIDC-compatible npm

[kjgbot]

Summary

• replace the floating npm@latest publisher install with exact npm@11.19.1
• keep npm OIDC trusted-publisher support while remaining compatible with the workflow's pinned Node 22.14.0
• assert the installed npm version before any package publish begins

Root cause

Release run 35501402680 resolved npm@latest to npm 12.0.2. npm 12 requires Node 22.22.2 or newer, so its engine check rejected the workflow's Node 22.14.0 and skipped every npm publish, including relayburn@4.1.0.

Verification

• npm registry metadata confirms npm 11.19.1 supports Node ^20.17.0 || >=22.9.0
• actionlint passes for the changed workflow after excluding one pre-existing SC2086 warning that is also present on origin/main
• YAML parse and git diff --check pass

---

Note

Low Risk
Workflow-only change to the global npm version used before publish; no runtime or package code changes.

Overview
Fixes release publishes failing when npm@latest resolves to npm 12, which refuses to run on the workflow’s pinned Node 22.14.0.

The publish job now installs exact npm@11.19.1 (still ≥ 11.5.1 for OIDC trusted publishing) instead of npm@latest, with a short comment documenting the engine mismatch. The step is renamed to Install OIDC-capable npm and adds a test "$(npm --version)" = "11.19.1" guard before pack/publish runs.

^{Reviewed by Cursor Bugbot for commit 867f310. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 02d2a51e-68a8-4ccf-89d1-1f632b530da4

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.