Pin npm publish workflows to npm 11 to unblock release jobs

[Copilot]

Publish to npm started failing in release PRs because the publish action upgrades npm to latest, which now resolves to npm 12; npm 12 rejects this repository’s npm-shrinkwrap.json during npm ci.
This PR constrains npm resolution in publish paths so release jobs continue using a compatible npm major.

• Root cause

  • Automattic/vip-actions/npm-publish and npm-publish-prerelease run npm install -g npm.
  • On runners, that now installs npm 12, and npm ci --ignore-scripts fails against npm-shrinkwrap.json.

• Workflow changes

  • Updated .github/workflows/npm-publish.yml to set NPM_CONFIG_TAG: next-11 for:
    • publish job (npm-publish action)
    • publish-prerelease job (npm-publish-prerelease action)
  • Added inline comments documenting the npm 12 + shrinkwrap incompatibility to prevent accidental regression.

• Why this shape

  • Keeps the existing shared vip-actions version unchanged.
  • Applies the smallest repo-local control to both release and prerelease publishing flows.

- uses: Automattic/vip-actions/npm-publish@c8022b66e78461df4f802b935dc0dbb8399f96bc
  env:
    # npm@12 no longer supports npm-shrinkwrap.json with npm ci in this repository.
    NPM_CONFIG_TAG: next-11

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None