Fix release workflow draft handling and npm OIDC authentication (#274)

* Fix release workflow to properly handle draft releases

- Split release creation into two steps to avoid immutable release error
- Step 1: Upload assets to draft release (draft: true)
- Step 2: Publish release without touching assets (draft: false)
- Resolves softprops/action-gh-release#653 issue with immutable releases

This ensures:
1. tagpr creates draft release correctly
2. Assets are uploaded to mutable draft release
3. Release is published only after assets are uploaded
4. No "Cannot upload assets to immutable release" errors

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

* Update npm to latest version for OIDC Trusted Publishers support

- Add npm update step to npm-publish job before dependencies installation
- Node.js 22 ships with npm 10.9.3, but OIDC Trusted Publishers requires npm 11.5.1+
- This ensures npm CLI can detect and use OIDC authentication properly
- Enables automatic provenance attestations for enhanced supply chain security

Combined with previous draft release workflow fix, this should resolve:
1. "Cannot upload assets to immutable release" error (draft handling)
2. npm publish authentication failures (npm version requirement)

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

---------

Co-authored-by: Claude <[email protected]>

Author: sugyan

.github/workflows/release.yml

@@ -122,12 +122,18 @@ jobs:
         with:
           path: ./artifacts
 
-      - name: Create release
+      - name: Upload release assets
         uses: softprops/action-gh-release@v2
         with:
           files: |
             artifacts/*/*
             frontend/demo-recordings/*.webm
+          draft: true
+          prerelease: false
+
+      - name: Publish release
+        uses: softprops/action-gh-release@v2
+        with:
           generate_release_notes: true
           draft: false
           prerelease: false
@@ -152,6 +158,9 @@ jobs:
             backend/package-lock.json
             frontend/package-lock.json
 
+      - name: Update npm to latest version
+        run: npm install -g npm@latest
+
       - name: Install backend dependencies
         run: npm ci
         working-directory: backend