ci: publish on Node 24 with a pinned npm

[JohnMcLear]

The bug

.github/workflows/npmpublish.yml ran the publish job on Node 25 and then
upgraded npm with npm install -g npm@latest. npm 12 requires
^22.22.2 || ^24.15.0 || >=26.0.0 — Node 25 is not in that range — so as soon
as npm 12 shipped, that step started dying:

npm error code EBADENGINE
npm error Not compatible with your version of node/npm: npm@12.0.2
npm error Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error Actual:   {"node":"v25.9.0","npm":"11.12.1"}

Every plugin's publish has been failing since.

The fix

• node-version: 25 → node-version: 24 — an LTS line that every npm 11.x
  and 12.x supports.
• npm@latest → npm@^11.5.1 — 11.5.1 is the floor OIDC trusted publishing
  needs. Pinning to a range rather than @latest means the next npm major
  dropping this Node line cannot silently break publishing fleet-wide again.
• Replaced the stale comment that still described Node 20.x.

No other change. Mirrors the merged pilot, ether/ep_align#227.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Fix npm publishing with Node 24 and pinned npm 11

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Runs npm publishing on the supported Node 24 LTS release.
• Constrains npm to version 11, preventing incompatible major upgrades.

High-Level Assessment

The selected approach is appropriate: Node 24 satisfies npm 11 and 12 engine constraints, while the npm 11 caret range preserves trusted-publishing support without exposing the workflow to incompatible future majors. Exact npm pinning would improve reproducibility but require manual patch updates, and retaining Node 25 cannot support npm 12.

Files changed (1) +9 / -5

Bug fix (1) +9 / -5

npmpublish.ymlUse a compatible Node and npm publishing toolchain +9/-5

Use a compatible Node and npm publishing toolchain

• Moves the publish job from Node 25 to Node 24 LTS and constrains npm upgrades to '^11.5.1'. Updated comments document the engine incompatibility and explain why future npm majors are excluded.

.github/workflows/npmpublish.yml