Upgrade pinned npm before audit exceptions expire

[endalk200]

The npm release workflow currently pins npm 11.18.0 and temporarily accepts nine exact advisory/package/bundled-version tuples in apps/cli/src/release/pinned-npm-audit.ts.

These exceptions expire at 2026-08-24T00:00:00.000Z. After that time, the release workflow will fail closed if any accepted finding remains.

Required work

• Check for a newer npm CLI whose bundled dependencies resolve the accepted findings.
• Upgrade every pinned npm version reference together, including the workflow and audit policy.
• Remove resolved exceptions; do not extend the deadline without reviewing each advisory and bundled version.
• Reproduce the pack, shrinkwrap, and production audit against the exact pinned npm tarball.
• Run the release audit, CLI build, package verification, and smoke test.

Acceptance criteria

• The pinned npm audit passes without expired exceptions.
• Any remaining exception is exact, documented, time-bounded, and covered by policy tests.
• The release workflow and PINNED_NPM_VERSION cannot drift from one another.

Related release: artiflow-cli-v0.4.0
Related fix: #39