ci: ensure latest npm for trusted publishing

Author: rozsival

.github/actions/setup/action.yaml

@@ -14,6 +14,11 @@ runs:
         node-version-file: .nvmrc
         registry-url: 'https://registry.npmjs.org'
 
+    # Ensure npm 11.5.1 or later for trusted publishing
+    - name: Ensure latest npm
+      shell: bash
+      run: npm install -g npm@latest
+
     - name: Cache
       uses: actions/cache@v5
       with: