fix(ci): publish with the npm CLI so OIDC trusted publishing works

[darkobas2]

The 0.1.0 publish failed with 404 Not Found - PUT even though the trusted publisher record is correct (ethersphere/core-sdk / publish_npmjs.yml / environment publish) and provenance signing succeeded:

npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm error 404 Not Found - PUT https://registry.npmjs.org/@ethersphere%2fcore-sdk

Cause

From the failed run's env:

NPM_CONFIG_USERCONFIG: /home/runner/work/_temp/.npmrc
NODE_AUTH_TOKEN: XXXXX-XXXXX-XXXXX-XXXXX

setup-node's registry-url always writes an .npmrc containing //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}. With no token supplied, NODE_AUTH_TOKEN is that literal placeholder. npm ≥ 11.5.1 detects OIDC is available and overrides the placeholder with a real trusted-publishing token. pnpm 10.29.2 sent the placeholder verbatim, and the registry answers 404 on PUT rather than 401/403 so it doesn't leak whether a package exists.

So this was never a permissions problem — it was an unauthenticated request wearing a placeholder token, and the 404 made it look like the package was missing.

For the record this is not pnpm/pnpm#11513 (OIDC broken in pnpm 11) — that regression landed in 11.0.8 and this run used 10.29.2.

Fix

npm publish instead of pnpm publish, and node 24 instead of 22 — node 24 is what pins npm to 11.x. This is exactly how swarm-cli publishes, which has five consecutive successful releases on it. pnpm still does install and build; only the publish call changes.

After merge

main is already at 0.1.0 and the core-sdk-v0.1.0 release exists, but npm only has 0.0.1. This fix: commit will have release-please open a 0.1.1 release PR — merging that cuts a release and gives the workflow a genuine end-to-end run. npm will end up with 0.0.1 and 0.1.1, skipping 0.1.0, which is a cosmetic gap in exchange for not hand-rolling tags.