ci: publish on Node 24 with a pinned npm

[JohnMcLear]

.github/workflows/npmpublish.yml ran the publish job on Node 25 and then
did npm install -g npm@latest. npm 12 requires
^22.22.2 || ^24.15.0 || >=26.0.0 — Node 25 is excluded — so that step died
with EBADENGINE and the package could never be published:

npm error code EBADENGINE
npm error Not compatible with your version of node/npm: npm@12.0.2
npm error Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error Actual:   {"node":"v25.9.0","npm":"11.12.1"}

Move the job to Node 24 (an LTS line supported by every npm 11.x and 12.x)
and pin the upgrade to npm@^11.5.1 — a range rather than @latest, so the
next npm major dropping this Node line can't silently break publishing
fleet-wide again. >=11.5.1 is what OIDC trusted publishing needs.

Same fix as ether/ep_align#227.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Fix npm publishing with Node 24 and pinned npm 11

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Run npm publishing on a supported Node 24 LTS runtime.
• Pin npm 11 to prevent incompatible major upgrades from breaking releases.

Diagram

graph TD
  A["Publish Workflow"] --> B["Node 24 LTS"] --> C["npm 11 CLI"] --> D["OIDC Publish"] --> E["npm Registry"]

Loading

High-Level Assessment

The selected approach is appropriate: Node 24 provides a supported LTS runtime, while npm@^11.5.1 satisfies trusted publishing requirements without allowing a future incompatible major. Node 22 or relying on the bundled npm were considered less direct and potentially less predictable.

Files changed (1) +9 / -5

Bug fix (1) +9 / -5

npmpublish.ymlUse Node 24 with a pinned npm 11 range +9/-5

Use Node 24 with a pinned npm 11 range

• Moves the publishing job from unsupported Node 25 to Node 24 LTS. Replaces npm@latest with npm@^11.5.1 so OIDC trusted publishing remains available without accepting incompatible future majors.

.github/workflows/npmpublish.yml