fix: use complete npm release CLI

[heimanba]

Root cause

The stable publish workflow stopped before contacting npm because the pinned [email protected] installation could not load its bundled sigstore dependency during npm publish --dry-run.

Fix

• pin the release runner to [email protected]
• print the effective npm version in the workflow log

Verification

• npm 12.0.1 provenance module loads successfully
• workflow YAML parses
• open-source repository invariant tests pass
• no package was published by the failed run

After merge, the same manually approved stable publish workflow will be retried.