ci(publish): use npx to run latest npm CLI (avoid global install conflict)

[0xkkkn]

Summary

Replaces npm install -g npm@latest + npm publish with a single npx --yes npm@latest publish .... The previous approach failed because the GitHub-hosted runner already has a system npm wired into pnpm's setup, and npm install -g npm@latest corrupted that install:

npm error code MODULE_NOT_FOUND
npm error Cannot find module 'promise-retry'
npm error - /opt/hostedtoolcache/node/22.22.2/x64/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/rebuild.js
...
##[error]Process completed with exit code 1.

npx --yes npm@latest publish ... fetches a fresh npm CLI into a temp folder for this single invocation, so it doesn't touch the runner's global npm.

Test plan

• After merge, force-update tag v0.2.1. Workflow re-runs with npx-spawned npm 11+ which supports trusted publisher OIDC auth.
• Confirm @privara/sdk@0.2.1 appears on https://www.npmjs.com/package/@privara/sdk.

Linked

• Linear: DEV-132
• Previous fixes: ci(publish): switch to npm trusted publisher (OIDC), remove NPM_TOKEN #8, ci(publish): use npm CLI for publish to enable trusted publisher OIDC auth #9
• Failed run: https://github.com/PrivaraXYZ/privara-sdk/actions/runs/25512525713