fix: bootstrap npm upgrade without broken system npm

Node 22.22.2 ships with broken npm (missing promise-retry module),
so any npm command fails. Download npm 11 tarball directly via curl
and use it to install itself globally, bypassing the broken system npm.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: tianzhou

.github/workflows/npm-publish.yml

@@ -58,9 +58,13 @@ jobs:
           node-version: "22"
 
       # Upgrade npm for OIDC trusted publishing support (requires npm 11.5+)
+      # Bootstrap without npm since Node 22.22.2 ships with broken npm (missing promise-retry)
       - name: Upgrade npm
         run: |
-          npm install -g npm@11
+          npm_tarball=$(curl -fsSL https://registry.npmjs.org/npm/latest-11 | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).dist.tarball")
+          curl -fsSL "$npm_tarball" | tar xz -C /tmp
+          node /tmp/package/bin/npm-cli.js install -g npm@11
+          rm -rf /tmp/package
           echo "npm version: $(npm --version)"
 
       # Install pnpm for faster and more reliable package management