Fix the npm publish release workflow (trusted publishing + tag push)

[grahamlangford]

Problem

The Publish workflow was failing in two places:

1. npm publish → 404 PUT ... Not found. npmjs trusted publishing and the workflow's id-token: write permission were correct, but Node 22.18.0 bundles npm 10.9.3, and OIDC trusted publishing requires npm >= 11.5.1. npm fell back to token auth using the placeholder NODE_AUTH_TOKEN that setup-node writes when no token is supplied → 404.
2. git push --follow-tags → 403 denied to github-actions[bot]. The workflow only granted contents: read, but pushing the version tag and running gh release create need contents: write.

Fix

• Bump .nvmrc to 24.18.0 (Node 24 "Krypton" LTS, npm 11.16.0). The publish workflow reads .nvmrc, so npm publish now uses OIDC trusted publishing (with automatic provenance). Node 22 never ships npm >= 11.5.1, so a within-22 bump wouldn't work. CI reads package.json, so it's unaffected.
• Change the workflow permission from contents: read to contents: write so the tag push and release creation succeed.

Both failures were observed in real dispatch runs; v0.36.0 published successfully once fix (1) was in place, then failed at the tag push.

🤖 Generated with Claude Code