The npm trusted publisher may only stage, so a version goes live once a maintainer approves it with 2FA. Staging needs npm 11.15 or later; Node 24.12 ships 11.6, so the job installs a pinned npm first.
No npm token: the workflow's OIDC identity is the npm trusted publisher, and npm records provenance for the tag's commit.