ci(publish): use npm CLI for publish to enable trusted publisher OIDC auth

[0xkkkn]

Summary

Switches the publish step from pnpm publish to npm publish and bumps Node to 22 + installs latest npm. The previous OIDC publish run failed because pnpm publish does not request the OIDC auth token from GitHub Actions (it only requests the OIDC token for provenance signing). Trusted publisher OIDC authentication is implemented in npm CLI ≥ 11.5.1.

Why

After PR #8 (removed NPM_TOKEN), the publish workflow run 25510021658 failed:

npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm error 404 Not Found - PUT https://registry.npmjs.org/@privara%2fsdk - Not found

Provenance was signed (Sigstore log entry) but the PUT to npm registry was rejected. Reason: pnpm signs provenance via OIDC but does not authenticate the publish request via OIDC. npm CLI does both natively when invoked with --provenance.

What

• node-version: 18 → 22
• New step: npm install -g npm@latest (Node 22 ships with npm 10.x, we need ≥ 11.5.1)
• pnpm publish --no-git-checks --provenance --access public → npm publish --provenance --access public
• Build/test/typecheck remain on pnpm — only the final publish step changes.

Test plan

• After merge, force-update tag v0.2.1 to point at this commit. Workflow re-runs with npm CLI 11+ and publishes via OIDC.
• Verify on https://www.npmjs.com/package/@privara/sdk that v0.2.1 is published.

Linked

• Linear: DEV-132
• Previous fix attempt: ci(publish): switch to npm trusted publisher (OIDC), remove NPM_TOKEN #8
• Failed run: https://github.com/PrivaraXYZ/privara-sdk/actions/runs/25510021658