ci: upgrade npm to 11.5.1+ for OIDC trusted publishing

Node 22 ships with npm 10.x, which doesn't support the OIDC
trusted-publishing token exchange. Without this upgrade, the
next release of @jdevalk/emdash-plugin-seo will fail with
ENEEDAUTH even though OIDC is configured on npmjs.com and the
publish.yml workflow is set up correctly (id-token: write, no
NPM_TOKEN, no NODE_AUTH_TOKEN placeholder).

Install npm@latest into a user-local prefix ahead of the
existing global npm to sidestep the self-upgrade bug
(MODULE_NOT_FOUND: promise-retry). The separate-prefix install
was diagnosed and fixed in the seo-graph repo during the
seo-graph-core 0.3.0 / astro-seo-graph 0.2.4 release cycle —
applying it here preemptively so the next plugin release
doesn't hit the same wall.

Single-package repo with no workspace deps, so no pnpm pack
dance is needed — plain `npm publish` on the fresh npm is
sufficient.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jdevalk

.github/workflows/publish.yml

@@ -23,4 +23,20 @@ jobs:
           # Leaving it off means no `.npmrc` is created, npm uses the
           # default registry (npmjs.org), and trusted publishing can
           # authenticate via the GitHub Actions OIDC token.
+      # Node 22 ships with npm 10.x, which doesn't support OIDC trusted
+      # publishing. Upgrade to 11.5.1+ so `npm publish` can complete the
+      # OIDC token exchange with the npm registry. Without this, the
+      # publish fails with ENEEDAUTH even though OIDC env is available.
+      #
+      # Install into a separate global prefix so npm isn't trying to
+      # upgrade itself in place — that hits a known bug where npm
+      # removes its own dependencies mid-install and then can't finish
+      # (MODULE_NOT_FOUND: promise-retry).
+      - name: Install npm 11.x into a separate prefix
+        run: |
+          mkdir -p "$HOME/.npm-global"
+          npm config set prefix "$HOME/.npm-global"
+          echo "$HOME/.npm-global/bin" >> "$GITHUB_PATH"
+          npm install -g npm@latest
+          "$HOME/.npm-global/bin/npm" --version
       - run: npm publish --provenance --access public