ci(publish-npm): bump to Node 24 to clear npm 11.5.1 floor for OIDC

[jagguji]

Summary

• Bump node-version: 22 → 24 in .github/workflows/publish-npm.yml so the runner gets npm 11.12.1+ natively. npm OIDC trusted publishing requires npm CLI >= 11.5.1.
• The previous npm install -g npm@latest workaround is not safe on the current runner image — see context below.

Why not just upgrade npm in place

Run 24882819896 (the very first OIDC attempt, before f269712) failed at exactly the npm install -g npm@latest step:

npm error code MODULE_NOT_FOUND
npm error Cannot find module 'promise-retry'

That's a known corruption in Node 22.22.2's bundled npm 10.9.7 inside the GitHub-hosted toolcache. Any global npm upgrade hits it. Shubham's f269712 ("removed the global npm installation step") was a real workaround for that crash, not just cleanup — but it left the runner on npm 10.9.7, which fails OIDC publish with E404 on PUT (the registry's stand-in for "this token can't authorize this PUT") because npm 10.x doesn't speak the trusted-publishing token-exchange protocol.

Bumping Node to 24 clears both problems at once:

• Node 24.15.0 ships npm 11.12.1 (per the Node 24 changelog)
• No fragile -g upgrade against a corrupted toolcache

What this PR does NOT fix

The trusted-publisher config on npmjs.com was originally registered for @subham_/rescript-blend. Commit 5787894 renamed the package to @juspay/rescript-blend but did not update the npmjs.com side. Even with the npm version fix in this PR, the publish will keep returning 404 on PUT until an admin on the @juspay npm org goes to npmjs.com → package settings and registers a trusted publisher for @juspay/rescript-blend pointing at:

• repo: juspay/blend-rescript
• workflow: publish-npm.yml
• environment: npm

(And likely creates the package under the @juspay scope first, since this would be its inaugural publish under that name.)

Test plan

• Trigger Publish to NPM with dry_run=true on this branch and confirm npm --version is 11.12.x (>= 11.5.1).
• Confirm with @juspay npm org admin that the trusted-publisher entry exists for @juspay/rescript-blend.
• After both are in place and this is merged, run a real publish (dry_run=false) and verify the package appears at @juspay/rescript-blend@0.0.37-beta.2 with --tag beta.

🤖 Generated with Claude Code