ci: restore npm upgrade for OIDC publishing (pin to npm@11)

Node 22 ships npm v10 which lacks OIDC support. The upgrade step was
removed in 02359f6 but is required for provenance-based publishing.
Pin to npm@11 instead of @latest to avoid future breakage.

.github/workflows/publish.yml

@@ -85,6 +85,8 @@ jobs:
         with:
           node-version: 22
           registry-url: 'https://registry.npmjs.org'
+      - name: Upgrade npm for OIDC support
+        run: npm install -g npm@11
       - name: Build
         run: cd js && npm ci && npm run build
       - name: Publish to npm