publish: use npx npm@11 to bypass PATH-shadowing for npm publish (#179)

`npm install -g npm@latest` installs into a path that the GitHub
runner doesn't put first in PATH, so subsequent `npm publish` still
runs the Node-bundled npm 10.x. OIDC trusted publishing requires
npm >= 11.5.1, so we ENEEDAUTH'd silently.

Fix: invoke npm via `npx -y npm@11 publish --access public`. npx
bypasses PATH and runs the exact pinned version. Also echo node +
npm versions for future diagnosis.

v3.8.3 PyPI shipped fine; npm failed with this exact ENEEDAUTH and
was yanked manually.

Author: LarsenCundric

.github/workflows/publish.yml

@@ -223,9 +223,16 @@ jobs:
         working-directory: browser-use-node
         run: pnpm build
 
-      - name: Upgrade npm to OIDC-capable version
-        run: npm install -g npm@latest
-
       - name: Publish to npm (OIDC trusted publishing)
         working-directory: browser-use-node
-        run: npm publish --access public
+        run: |
+          set -euo pipefail
+          # Node 22 ships with npm 10.x; OIDC trusted publishing requires
+          # npm >= 11.5.1. `npm install -g npm@latest` on the GitHub runner
+          # puts the new binary on a PATH that doesn't shadow the bundled
+          # npm, so `npm publish` still picks up the old 10.x. Bypass by
+          # invoking the version explicitly via npx.
+          NPM_VERSION="11"
+          echo "Node:    $(node --version)"
+          echo "npm:     $(npx -y npm@${NPM_VERSION} --version)"
+          npx -y npm@${NPM_VERSION} publish --access public