fix(ci): pin npm to 11.x for OIDC publish; npm 12 rejects unknown flags (#47)

`npm@latest` from #45 resolved to 12.0.2, which flipped a breaking change:

> unknown CLI flags, abbreviated flags, and single-hyphen multi-char
> shorthands now throw instead of warning.

`pnpm publish` (used by `changeset publish` in this pnpm workspace) calls
`npm publish` under the hood and forwards the original argv verbatim,
including `--no-git-checks` — a pnpm-only flag. npm 10 silently ignored
it, npm 12 errors with `EUNKNOWNCONFIG - Unknown cli flag: --git-checks`
and every scoped package publish fails.

Pin to `npm@11` instead: it has OIDC trusted publishing (added in 11.5.1)
and still tolerates unknown flags with a warning, which is exactly what
the pnpm → npm publish handoff needs.

Author: zsy-jason

.github/workflows/release.yml

@@ -50,9 +50,11 @@ jobs:
 
       - name: Install Dependencies
         run: |
-          # npm >=11.5.1 is required for OIDC trusted publishing. Node 22 ships
-          # with npm 10.x, so upgrade explicitly before `changeset publish` runs.
-          npm i -g npm@latest
+          # OIDC trusted publishing requires npm >=11.5.1; Node 22 ships with
+          # npm 10.x. Pin to 11.x because npm 12 turned unknown CLI flags into
+          # errors, which trips `pnpm publish` forwarding `--no-git-checks` to
+          # `npm publish`.
+          npm i -g npm@11
           npm i -g corepack@latest --force
           corepack enable
           pnpm install