ci: stage releases for 2FA approval instead of publishing them

The npm trusted publisher may only stage, so a version goes live once a
maintainer approves it with 2FA. Staging needs npm 11.15 or later; Node 24.12
ships 11.6, so the job installs a pinned npm first.

.github/workflows/publish.yml

@@ -1,8 +1,10 @@
-# Publishes @crudy/pgmorbac to npmjs on version tags (v<major>.<minor>.<patch>)
+# Stages @crudy/pgmorbac to npmjs on version tags (v<major>.<minor>.<patch>)
 # through npm trusted publishing: GitHub's OIDC token stands in for an npm
 # token, and npm attaches a provenance statement naming this repository and
-# commit. The organisation only allows its own actions, so checkout and Node
-# setup are plain shell. prepack downloads the signed crudylabs/pgmorbac
+# commit. The trusted publisher may only stage: a staged version goes live once
+# a maintainer approves it with 2FA (npm stage approve, or npmjs.com). The
+# organisation only allows its own actions, so checkout and Node setup are
+# plain shell. prepack downloads the signed crudylabs/pgmorbac
 # release of the same version and verifies it, so that release must exist
 # before this tag is pushed.
 name: publish
@@ -37,6 +39,8 @@ jobs:
           tar -xJf "$file" -C "$RUNNER_TEMP/node" --strip-components=1
           rm "$file"
           echo "$RUNNER_TEMP/node/bin" >> "$GITHUB_PATH"
+      - name: Install npm with staged publishing
+        run: npm install -g npm@11.21.1
       - run: npm install --no-audit --no-fund
       - run: npm test
       - name: Publish
@@ -47,5 +51,5 @@ jobs:
           if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then
             echo "$NAME@$VERSION is already published"
           else
-            npm publish --access public
+            npm stage publish
           fi