Pin publish workflow to npm 11 to fix broken npm publishing

[schani]

Root cause

Every Publish npm packages run since 2026-07-10 fails (last success: 2026-07-07, #2891). The failing step is npm install -g npm@latest:

npm error engine Not compatible with your version of node/npm: npm@12.0.0
npm error notsup Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error notsup Actual:   {"npm":"10.9.2","node":"v22.14.0"}

Upstream npm released 12.0.0 to the latest dist-tag between Jul 7 and Jul 10; it requires Node ^22.22.2 || ^24.15.0 || >=26, but the workflow runs the .nvmrc-pinned Node v22.14.0 → EBADENGINE. Today's dependabot merges only triggered the master pushes that exposed this — the failure is upstream, and their npm ci + npm run build steps all passed on master.

Fix

Pin the upgrade to npm@11 (currently 11.18.0):

• Trusted Publishing needs npm ≥ 11.5.1 ✓
• npm 11 supports Node ^20.17.0 || >=22.9.0, compatible with v22.14.0 ✓
• This is the exact npm major the last successful publish used, and it won't break again on future latest engine bumps.

The alternative (bumping .nvmrc to ≥ 22.22.2) touches every CI job and still leaves publishes exposed to the next npm engines change. (PR #2892 modernizes Node across the repo; when it lands it can revisit this pin.)

Not fixed here (needs maintainer action)

Publish VS Code extension fails for an unrelated reason: the VSCE_TOKEN Personal Access Token has expired ("Access Denied: The Personal Access Token used has expired"). A new Azure DevOps marketplace PAT needs to be generated and the repo secret updated — that cannot be fixed from a PR.

Note: more dependabot lockfile PRs are still landing (2893, 2839); they don't affect this workflow-only change.

🤖 Generated with Claude Code