chore: pin release job to Node 26 and bump CI to Node 24

- Release job: pin Node 26 (bundles npm 11.16.0 >= 11.5.1) and drop the
  manual npm upgrade step it makes redundant.
- CI job: bump Node from 16 to 24 so the dependency tree, including
  semantic-release (engine ^22.14.0 || >= 24.10.0), is compatible.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Marcosld

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
         strategy:
             matrix:
                 os: [windows-latest, ubuntu-latest]
-                node_version: [16]
+                node_version: [24]
         name: CI on NodeJS v${{ matrix.node_version }} and ${{ matrix.os }}
         runs-on: ${{ matrix.os }}
         steps:

.github/workflows/release.yml

@@ -27,16 +27,13 @@ jobs:
 
             # Do NOT set registry-url here: it writes an .npmrc that conflicts
             # with semantic-release's OIDC authentication.
+            # Node 26 bundles npm >= 11.5.1, required for OIDC trusted publishing.
             - uses: actions/setup-node@v4
               with:
-                  node-version: 24
+                  node-version: 26
 
             - run: yarn install --frozen-lockfile
 
-            # npm OIDC trusted publishing requires npm >= 11.5.1; upgrade to be
-            # independent of the version bundled with Node 24.
-            - run: npm install -g npm@latest
-
             - name: Release
               env:
                   GITHUB_TOKEN: ${{ secrets.FLOW_GITHUB_TOKEN }}