ci: pin node version and upgrade npm for oidc trusted publishing

Author: hiddentao

.github/workflows/release.yml

@@ -44,9 +44,12 @@ jobs:
       - name: Setup Node (for npm publish with OIDC)
         uses: actions/setup-node@v4
         with:
-          node-version: "22"
+          node-version: "22.14.0"
           registry-url: "https://registry.npmjs.org"
 
+      - name: Upgrade npm to latest (required for OIDC trusted publishing)
+        run: npm install -g npm@latest
+
       - name: Install dependencies
         run: bun install --frozen-lockfile