ci: publish on Node 24 with a pinned npm

[JohnMcLear]

.github/workflows/npmpublish.yml ran the publish job on Node 25 and then
did npm install -g npm@latest. npm 12 requires
^22.22.2 || ^24.15.0 || >=26.0.0 — Node 25 is excluded — so that step died
with EBADENGINE and the package could never be published:

npm error code EBADENGINE
npm error Not compatible with your version of node/npm: npm@12.0.2
npm error Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error Actual:   {"node":"v25.9.0","npm":"11.12.1"}

Move the job to Node 24 (an LTS line supported by every npm 11.x and 12.x)
and pin the upgrade to npm@^11.5.1 — a range rather than @latest, so the
next npm major dropping this Node line can't silently break publishing
fleet-wide again. >=11.5.1 is what OIDC trusted publishing needs.

Same fix as ether/ep_align#227.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Fix npm publishing with Node 24 and pinned npm 11

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Runs trusted npm publishing on the compatible Node 24 LTS line.
• Pins npm 11 to prevent future major releases from breaking publication.

Diagram

sequenceDiagram
    participant W as Publish Job
    participant S as setup-node
    participant N as npm CLI
    participant R as npm Registry
    W->>S: Select Node 24
    S-->>W: Compatible runtime
    W->>N: Install npm ^11.5.1
    N-->>W: OIDC-capable CLI
    W->>R: Trusted publish

Loading

High-Level Assessment

The chosen approach is appropriate: Node 24 is an LTS release compatible with the required npm versions, while the npm 11 range satisfies trusted publishing without exposing the workflow to incompatible future majors. Using npm@latest was considered but caused the original failure and remains unnecessarily risky.

Files changed (1) +9 / -5

Bug fix (1) +9 / -5

npmpublish.ymlUse Node 24 and pin npm 11 for publishing +9/-5

Use Node 24 and pin npm 11 for publishing

• Changes the publishing runtime from unsupported Node 25 to Node 24 LTS. Replaces npm@latest with npm@^11.5.1 to retain OIDC support while preventing incompatible major upgrades.

.github/workflows/npmpublish.yml