fix(ci): unpin Node/npm engine mismatch breaking publish (#57)

`npm install -g npm@latest` began resolving to npm 12.0.1, whose engines
require Node ^22.22.2 || ^24.15.0 || >=26.0.0. The release workflow pins
Node 22.14.0, so the step failed with EBADENGINE and the v1.0.0 publish
never ran. Nothing in the repo changed -- npm 12 shipped and moved the
floor under a floating dist-tag.

Bump Node to 22.23.1 (current v22 LTS patch, satisfies ^22.22.2) and pin
npm to the major (npm@12) so the next npm major cannot silently break
releases again. The step exists only because Node 22 bundles npm 10.9.x,
which predates the OIDC trusted publishing support added in 11.5.1.

Node is bumped in ci.yml too, since CI and release are deliberately kept
on the same pin and drift between them is its own hazard.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: yosriady

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22.14.0"
+          node-version: "22.23.1"
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -56,7 +56,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22.14.0"
+          node-version: "22.23.1"
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -79,7 +79,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22.14.0"
+          node-version: "22.23.1"
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -105,7 +105,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22.14.0"
+          node-version: "22.23.1"
           cache: 'pnpm'
 
       - name: Install dependencies

.github/workflows/release.yml

@@ -40,12 +40,15 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22.14.0"
+          node-version: "22.23.1"
           # No registry-url - using OIDC trusted publishing instead
           # No cache - mitigates cache-poisoning risk in publish workflow
 
       - name: Update npm for trusted publishing
-        run: npm install -g npm@latest
+        # Pin the major: each npm major raises its minimum Node version, so
+        # `npm@latest` silently breaks this job whenever a new major lands
+        # (npm 12 requires Node ^22.22.2). Bump this alongside node-version.
+        run: npm install -g npm@12
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile