Pin the toolchain

Runs 2 through 4 published fine over OIDC. Run 6 failed inside npm publish with a 401, trying to open a browser web-auth flow — after the tarball had uploaded and the provenance statement was signed. Nothing in the repository had changed in any way that touches authentication.

Node 24 already bundles npm 11.5.1 or later, which is all trusted publishing needs. Use the bundled npm and assert the floor.