Fix Release workflow by installing npm via tarball

[mishushakov]

Summary

• The Release workflow was failing on npm install -g npm@^11.6 because the pre-installed npm 10.9.x on the Node 22 runner image ships with a broken @npmcli/arborist (missing promise-retry), which crashes during reify.
• Replace the global install with a tarball extract into the Node toolcache's node_modules/npm, pinned to npm 11.9.0. npm 11+ is still required for OIDC trusted publishing (NPM_TOKEN: "").

Test plan

• Merge and verify the next Release run passes the Update npm step

[cursor]

PR Summary

Low Risk
Workflow-only change to how npm is installed during releases; main risk is breakage if the runner’s Node/npm directory layout differs from assumptions.

Overview
Fixes the release.yml workflow’s npm upgrade step on Node 22 by bootstrapping npm via tarball extraction (installing npm 10.9.8 directly into the runner’s npm directory) before running npm install -g npm@^11.6.

Also removes the explicit NPM_TOKEN: "" override from the Changesets publish step, relying on the workflow’s OIDC/trusted publishing setup instead.

^{Reviewed by Cursor Bugbot for commit 8565b0d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8565b0d. Configure here.}

[cursor]

Removed required NPM_TOKEN for OIDC trusted publishing

High Severity

The NPM_TOKEN: "" environment variable was removed from the "Release new versions" step. This empty-string value is required by changesets/action to signal that OIDC trusted publishing is being used instead of a traditional token. Without it, the action writes "undefined" into .npmrc, causing npm publish to fail. The PR description even references NPM_TOKEN: "" as essential for OIDC trusted publishing, so this removal appears accidental.

 

^{Reviewed by Cursor Bugbot for commit 8565b0d. Configure here.}