Pin npm to 11 in release workflow

[KennethWussmann]

Why

The 0.3.2 release published to npm successfully, with provenance, so trusted publishing itself is working. The job still failed, but one step later, in pack:tarballs:

Error: Command failed: npm pack --unsafe-perm
npm error code EUNKNOWNCONFIG
npm error Unknown cli flag:
npm error   - --unsafe-perm

This was self-inflicted by the trusted publishing PR. That PR added npm install -g npm@latest because trusted publishing needs npm >= 11.5.1, but npm@latest is now 12.0.2, and npm 12 removed --unsafe-perm entirely. oclif@6.0.0 hardcodes npm pack --unsafe-perm in tarballs/build.js:175, and 6.0.0 is the newest oclif, so there is no version to upgrade into.

What

Pinned the step to npm@11 (currently 11.19.1), which satisfies both constraints:

• 11.19.1 >= 11.5.1, so trusted publishing works.
• npm 11 still accepts --unsafe-perm, warning that it stops working in the next major, which is exactly the npm 12 behaviour above.

Note

This is a holding pattern, not a permanent fix. Once oclif drops --unsafe-perm, the pin can move back to npm@latest. Until then, bumping to npm 12 will break tarball packing again.

Written by Claude Opus 5 via Pi