[codex] Fix trusted publishing npm upgrade step

[ejntaylor]

Summary

• Removes the failing npm install -g npm@latest self-upgrade step from the publish workflow.
• Runs the publish job on Node 24 instead, which ships a trusted-publishing-capable npm version.
• Adds a lightweight tool-version log step so release runs show the exact Node/npm versions used.

Why

The release workflow failed while trying to replace npm globally on the GitHub runner:

npm error Cannot find module 'promise-retry'
npm error Require stack: ... @npmcli/arborist ...

Avoiding npm self-mutation in the release job is more reliable than upgrading npm in place.

Validation

• npm test
• npm run typecheck