Fix publish workflow failure caused by runtime npm upgrade

[Copilot]

The publish GitHub Actions job fails during npm publish with Cannot find module 'sigstore'. The failure is introduced by upgrading npm at runtime in the workflow before publishing.

• Root cause addressed

  • Removed runtime npm self-upgrade from the publish workflow (npm install -g npm@latest), which was destabilizing npm’s publish/provenance path on the runner.

• Workflow behavior after change

  • Keep Node setup via actions/setup-node@v4 (Node 24).
  • Publish using the runner-provided npm from setup-node, preserving OIDC trusted publishing flow:
    • npm publish --access public

• Files changed

  • .github/workflows/publish.yml

# removed
- name: Update npm
  run: npm install -g npm@latest

# unchanged publish path
- name: Publish to npm
  run: npm publish --access public