fix(ci): pin release npm to 11.x so trusted publishing works on Node 20

[chrisli30]

Problem

The Release workflow has been failing since npm rolled @latest to 12.0.1. The Upgrade npm for trusted publishing step runs npm install --global npm@latest, but npm 12 dropped Node 20 support:

npm error EBADENGINE  Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
                      Actual:   {"npm":"10.8.2","node":"v20.20.2"}

The workflow pins node-version: 20, so the step dies with EBADENGINE and the Release job aborts before changesets/action can open the chore: version packages PR or publish. Net effect: merges to main no longer produce a release (observed on the run triggered by #20).

Fix

Pin the npm upgrade to the 11.x line:

- run: npm install --global npm@latest
+ run: npm install --global "npm@^11.5.1"

• npm 11.x supports Node 20.17+, so no EBADENGINE.
• npm >= 11.5.1 already supports OIDC trusted publishing, so the no-NPM_TOKEN publish path is preserved.
• Minimal, deterministic unblock — no Node bump. Comment added noting to raise npm + node-version together when moving to npm 12+.

After merge

Merging this re-triggers Release on main, which will open the pending chore: version packages PR (the @avaprotocol/protocols 0.8.0 bump from the still-unconsumed changeset added in #20). Merging that publishes 0.8.0 over OIDC.

🤖 Generated with Claude Code