ci: fix OIDC publish on Node 20 and allow manual re-run

.github/workflows/publish.yml

@@ -3,6 +3,8 @@ name: Publish
 on:
   release:
     types: [published]
+  # Manual re-run from the default branch, e.g. when a release publish failed.
+  workflow_dispatch:
 
 jobs:
   publish:
@@ -12,13 +14,17 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v4
-      - name: Use Node.js 20.x
+      - name: Use Node.js 24.x
         uses: actions/setup-node@v4
         with:
-          node-version: 20.x
+          node-version: 24.x
           registry-url: https://registry.npmjs.org/
       - name: Upgrade npm for OIDC trusted publishing
-        run: npm install -g npm@latest
+        # Trusted publishing needs npm >= 11.5.1. Pin the 11 line: npm@latest
+        # is now 12.x, which refuses to install on older Node runners.
+        run: |
+          npm install -g npm@11
+          npm --version
       - name: NPM Publish
         run: |
           npm install