[LOW] security(ci): pin the release npm version

[OskarEichler]

Security impact

The privileged release job installs npm@^11.5.1 immediately before publishing. That range resolves again on every release, so a newly published npm 11.x version can execute with repository write and npm OIDC privileges before this repository has reviewed it.

Fix

Pin the install to npm 11.19.1, the current npm 11 release. npm 12 is not selected because this workflow runs Node 20 and npm 12 requires a newer Node line; npm 11.19.1 supports Node ^20.17.0 or >=22.9.0 and retains the required trusted-publishing support.

This PR changes only the floating release-tool version. Action revision pins and workflow permissions are separate focused changes.

Verification

• npm 11.19.1 resolves and reports the expected version
• Package engine compatibility was checked against the workflow's Node 20 runtime
• release.yml parses successfully as YAML
• git diff --check passes

No runtime package changes or changeset are needed for CI-only hardening.

[vercel]

@OskarEichler is attempting to deploy a commit to the Nearform Team on Vercel.

A member of the Team first needs to authorize it.

[ilteoood]

At this point, installing the latest 11 version would be more than enough

Suggested change

	run: npm i -g npm@11.19.1
	run: npm i -g npm@11

[changeset-bot]

⚠️ No Changeset found

Latest commit: db879ae

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[OskarEichler]

Applied your suggestion in db879ae: the release workflow now installs npm@11 instead of pinning a patch version. YAML parsing and git diff --check pass. I have not run the privileged publishing workflow.