fix(ci): use Node 24 + npm 11+ and drop registry-url for OIDC publish

Two issues caused the 404 Trusted Publishing failure:

1. Node 22 ships with npm 10.9.7, but OIDC Trusted Publishing needs
   npm >= 11.5.1. Upgrade to Node 24 (ships npm 11+) and explicitly run
   'npm install -g npm@latest' as belt-and-suspenders.

2. actions/setup-node with registry-url auto-writes a .npmrc entry
   with _authToken=${NODE_AUTH_TOKEN}. When npm publish sees ANY token
   config, it uses token auth and skips OIDC entirely. Empty token
   fails → 404 (scoped-package auth-leak protection).
   Drop registry-url so npm CLI handles registry + OIDC itself.