Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missing `sigstore` and breaks `npm publish`