Release jobs ran `npm install -g npm@latest` before each publish step,
adding ~30 s and version drift risk on every run; removed both occurrences,
relying on Node 24's bundled npm pinned via setup-node. Added a policy test
(tests/policy-release-no-npm-self-upgrade.test.cjs) that will fail RED if
the antipattern is re-introduced in release.yml or hotfix.yml. Fixes#318.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
