ci(publish): activate npm via Corepack for OIDC provenance

Global npm install -g failed on Node 22.22.x (MODULE_NOT_FOUND: promise-retry in
@npmcli/arborist). Use corepack prepare instead of upgrading through the broken
bundled npm. Drop check-latest on setup-node to match integration tests and
avoid bleeding-edge toolchains.

Made-with: Cursor

Author: proxymeshai

.github/workflows/publish.yml

@@ -51,12 +51,17 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version: 22
-          check-latest: true
           cache: npm
 
+      # Corepack avoids `npm install -g npm` when the bundled global npm is broken (e.g. missing promise-retry).
       - name: Upgrade npm for trusted publishing (OIDC)
         if: steps.gate.outputs.publish == 'true'
-        run: npm install -g npm@">=11.5.1"
+        env:
+          COREPACK_ENABLE_DOWNLOAD_PROMPT: 0
+        run: |
+          corepack enable
+          corepack prepare npm@11.5.1 --activate
+          npm --version
 
       - name: Ensure versions match
         if: steps.gate.outputs.publish == 'true'