fix(ci): require Node 24 for OIDC trusted publishing

Node 22's bundled npm 10 fails the OIDC publish with a misleading E404/ENEEDAUTH; Node 24 (npm 11+) completes the trusted-publisher handshake.