Node 22 ships npm 10.x which doesn't support trusted publishing via
OIDC (requires npm 11.5.1+). Node 24 bundles it natively, removing the
need for the `npm install -g npm@latest` step which was failing with a
`Cannot find module 'promise-retry'` error due to npm corrupting itself
during self-upgrade.
GITHUB_TOKEN can't trigger CI on PRs it creates, so the changesets
release PR could never pass required checks. Use a GitHub App token
instead, which triggers workflows normally.
Also pins all actions to commit SHAs and uses frozen lockfile.