Fix release clean install

[fraserxu]

What changed

• Pin the release workflow to npm 11.6.1, matching the version used by the green CI matrix.

Why

The v2.0.0 release run installed npm 11.18.0, then failed during npm ci because that npm version rejected the existing lockfile's optional @emnapi dependency resolution. The publish step never ran.

Impact

Release-triggered installs can complete again, allowing trusted publishing to reach npm publish.

Validation

• npm ci with Node 24.10.0 and npm 11.6.1
• npm run check (typecheck, 12 tests, build)
• npm pack --dry-run

---

Note

Low Risk
Single workflow version pin with no application or dependency logic changes.

Overview
The release workflow’s global npm install is downgraded from 11.18.0 to 11.6.1, aligning with the version already pinned in the CI matrix.

This avoids npm ci failing on publish (e.g. v2.0.0) when newer npm rejects the lockfile’s optional @emnapi resolution, so the publish step can run again.

^{Reviewed by Cursor Bugbot for commit 957f818. Bugbot is set up for automated code reviews on this repo. Configure here.}