ci: publish on Node 24 with a pinned npm

[JohnMcLear]

.github/workflows/npmpublish.yml ran the publish job on Node 25 and then
did npm install -g npm@latest. npm 12 requires
^22.22.2 || ^24.15.0 || >=26.0.0 — Node 25 is excluded — so that step died
with EBADENGINE and the package could never be published:

npm error code EBADENGINE
npm error Not compatible with your version of node/npm: npm@12.0.2
npm error Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error Actual:   {"node":"v25.9.0","npm":"11.12.1"}

Move the job to Node 24 (an LTS line supported by every npm 11.x and 12.x)
and pin the upgrade to npm@^11.5.1 — a range rather than @latest, so the
next npm major dropping this Node line can't silently break publishing
fleet-wide again. >=11.5.1 is what OIDC trusted publishing needs.

Same fix as ether/ep_align#227.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Publish with Node 24 and pinned npm 11

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Runs npm publishing on supported Node 24 LTS instead of incompatible Node 25.
• Pins npm to compatible 11.x releases while retaining trusted publishing support.

Diagram

graph TD
  A["Publish Workflow"] -->|configures| B["Node 24"] -->|installs| C["npm 11.x"] -->|publishes via OIDC| D[("npm Registry")]

Loading

High-Level Assessment

The chosen approach is appropriate: Node 24 provides an LTS runtime, while the npm ^11.5.1 range preserves trusted publishing support and accepts npm 11 fixes without risking an incompatible major upgrade. Retaining Node 25 or using npm@latest would reintroduce avoidable compatibility risk.

Files changed (1) +9 / -5

Bug fix (1) +9 / -5

npmpublish.ymlUse Node 24 with a compatible npm 11 range +9/-5

Use Node 24 with a compatible npm 11 range

• Moves the publishing job from unsupported Node 25 to Node 24 LTS. Replaces npm@latest with npm@^11.5.1 to satisfy OIDC trusted publishing requirements without automatically adopting incompatible future majors.

.github/workflows/npmpublish.yml