ci(publish-npm): upgrade npm so OIDC Trusted Publishing works

npm OIDC Trusted Publishing requires npm >= 11.5.1, but the publish job
runs on Node 20 which bundles npm 10.x. On npm 10 the OIDC publish step
signs provenance but cannot authenticate tokenlessly, so it falls through
to an unauthenticated publish and fails with E404 ("not in this
registry"). Install npm@latest after setup-node, before the publish
steps, so the OIDC path can actually authenticate.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: yanxue06

.github/blocks/publish-npm/action.yaml

@@ -46,6 +46,15 @@ runs:
         node-version: ${{ inputs.node-version }}
         registry-url: 'https://registry.npmjs.org'
 
+    # npm OIDC Trusted Publishing requires npm >= 11.5.1, but Node 20 ships
+    # npm 10.x. Without this, the OIDC publish below signs provenance yet can't
+    # authenticate tokenlessly, so it publishes unauthenticated and 404s.
+    - name: Upgrade npm for OIDC Trusted Publishing
+      shell: bash
+      run: |
+        npm install -g npm@latest
+        echo "npm version: $(npm --version)"
+
     - name: Install dependencies
       shell: bash
       working-directory: ${{ inputs.working-directory }}