ci: pin npm for Node 20 releases

[toakleaf]

Summary

• pin the Release workflow to npm 11.18.0
• keep OIDC trusted publishing support on the existing Node 20 runner
• prevent future npm majors from silently raising the Node requirement and breaking releases

Root cause

The post-merge Release run failed while installing npm@latest. That now resolves to npm 12.0.1, which requires Node 22.22.2 or newer, while the workflow runs Node 20.20.2.

Failed run: https://github.com/toakleaf/less.go/actions/runs/29449470140

Verification

• confirmed npm 11.18.0 declares Node support for ^20.17.0 || >=22.9.0
• parsed .github/workflows/release.yml as YAML
• git diff --check