Un-pin npm in release.yml once npm/cli#9722 (missing sigstore in npm 12) is fixed #186

The release workflow pins npm to the ^11 range (PR #185 exact pin, widened by PR #188) because npm 12.0.0 shipped without the sigstore module its own provenance/publish path requires — upstream bug npm/cli#9722 (the v0.7.1 publish-npm job failed twice on it; trusted publishing auto-enables provenance so every publish hits it).

Orchestrator standing instruction

Check upstream on every monitoring loop (the same slow cadence as PR/label polling):

1. gh issue view 9722 --repo npm/cli --json state,comments — look for a linked fix PR, a maintainer response, or the issue closing.
2. If closed/fixed: check which npm version carries the fix (npm view npm@latest version + the fix PR's milestone/changelog), and post here what you found.
3. When a fixed 12.x is confirmed: label this issue agent-ready is NOT needed — instead tell the human it's ready, and on their word open a PR moving release.yml from npm@^11 to the fixed line (^12 or @latest), noting the next release will verify it with a real publish.
4. Until then, note significant upstream movement here (new comments, linked PRs) so the trail stays on this issue.

Do not move off ^11 without a verified upstream fix — the failure mode costs a release-day debugging loop (see v0.7.1: two failed publishes + a tag move).