chore: pin npm to 11.5.1 with retry and sync lockfile

The bundled npm on Node 22 crashes mid self-upgrade
(`Cannot find module 'promise-retry'`); a second run completes
the install cleanly. Pin 11.5.1 (first version with OIDC
Trusted Publishing) so the build is reproducible. Also
regenerate package-lock.json to pick up version 0.1.1 and
engines.node >=20.0.0.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: tepeumut

.github/workflows/publish.yml

@@ -57,8 +57,14 @@ jobs:
       # Node 22 ships with npm 10.x, which silently publishes unauthenticated
       # and fails with a 404 on first publish. Upgrade before `npm ci` so the
       # lockfile install also runs on the new npm.
+      #
+      # The `|| npm install -g npm@...` retry works around a known self-upgrade
+      # bug where the bundled npm drops `promise-retry` mid-reify and crashes;
+      # a second run completes the upgrade cleanly.
       - name: Upgrade npm for OIDC Trusted Publishing
-        run: npm install -g npm@latest
+        run: |
+          npm install -g npm@11.5.1 || npm install -g npm@11.5.1
+          npm --version
 
       - name: Install dependencies
         run: npm ci