fix: stop upgrading release workflows to broken npm 12

[jlitola]

Problem

The MCP Package Release validation job on main failed with:

npm error Cannot find module 'sigstore'
npm error Require stack:
npm error - .../libnpmpublish/lib/provenance.js

Root cause

npm 12.0.0 (dist-tag latest since 2026-07-08) has a packaging bug (npm/cli#9722): its tarball ships sigstore under node_modules/ but does not declare it in npm's own dependencies/bundleDependencies. npm install -g npm@latest therefore prunes it as extraneous ("removed 18 packages" in the run log), and every subsequent npm publish — including --dry-run — crashes loading libnpmpublish/lib/provenance.js. Reproduced locally with a temp-prefix install of npm 12.0.0.

It surfaced only now because earlier runs since July 8 skipped the publish/dry-run paths (versions already published). Both release.yml and mcp-release.yml publish steps were broken; the root workflow simply hadn't been exercised.

Fix

Remove the Update npm (npm install -g npm@latest) steps from release.yml and both mcp-release.yml jobs. The step existed only because trusted publishing requires npm ≥ 11.5.1, but the pinned .node-version (24.15.0) bundles npm 11.12.1, which already satisfies it. Comments now document the requirement and warn against reintroducing npm@latest.

Verification

• bun run validate:packages:mcp-publish passes locally on bundled npm 11.12.1 (same version CI will now use; ci.yml already runs this path without the npm upgrade and passes).
• This PR touches mcp-release.yml, so the MCP package validation job runs on the PR and exercises the exact npm publish --dry-run path with the bundled npm.
• The first post-merge release is the end-to-end confirmation for the real publish steps.

🤖 Generated with Claude Code