publish: use npm instead of pnpm (fix trusted publishing)

[pdrbrnd]

Summary

Switch the publish step from `pnpm publish` to `npm publish`. pnpm doesn't perform the OIDC token exchange that npm trusted publishing requires — the 0.2.0 release failed with `ENEEDAUTH` because pnpm fell straight through to legacy token auth, ignoring the `id-token: write` permission.

Changes

• Keep `pnpm install --frozen-lockfile` (uses the lockfile, no change to install behavior).
• Add `npm install -g npm@latest` before publish — node 22's bundled npm is 10.x, but trusted publishing landed in npm 11.5.1+.
• Replace `pnpm publish --no-git-checks --access=public --provenance` with `npm publish --access=public --provenance`. (No `--no-git-checks` because npm doesn't have that flag; it doesn't run the same git checks pnpm does.)

Test plan

• Merge this
• Cut the next release tag (any `biome-config-v*` or `tsconfig-v*` patch bump) and confirm the workflow publishes successfully

🤖 Generated with Claude Code