ci: pin publish npm to 11.x — npm@12.0.0 lacks sigstore under prefix install

npm@12.0.0 (released 2026-07-08) installed via `npm install --prefix`
is missing its sigstore module, so `npm publish` fails with
MODULE_NOT_FOUND before reaching the registry. 11.x still satisfies
the >= 11.5.1 trusted-publishing requirement.

Author: Jannchie

.github/workflows/publish.yml

@@ -50,9 +50,12 @@ jobs:
       # npm >= 11.5.1 is required for trusted publishing (OIDC).
       # Install into a separate prefix first to avoid the self-overwrite
       # MODULE_NOT_FOUND bug seen when npm rewrites its own files in place.
+      # Pinned to the 11.x line: npm@12.0.0 installed this way is missing
+      # its `sigstore` module and `npm publish` dies with MODULE_NOT_FOUND
+      # (broke the v0.7.6 release, 2026-07-09).
       - name: Upgrade npm
         run: |
-          npm install --prefix "$RUNNER_TEMP/npm-upgrade" npm@latest
+          npm install --prefix "$RUNNER_TEMP/npm-upgrade" npm@11
           echo "$RUNNER_TEMP/npm-upgrade/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Install dependencies