ci: publish to npm with the npm CLI instead of pnpm (#213)

The `4.0.0` release-please run tagged `package-v4.0.0` and created the
GitHub Release, but the **publish job failed**: it built and signed
provenance, then died on the upload with `404 Not Found - PUT
https://registry.npmjs.org/@alchemy_cms%2fjson_api`.

That is the pnpm OIDC trusted-publishing bug
([pnpm/pnpm#11513](pnpm/pnpm#11513)): pnpm
generates the provenance (via sigstore, which is why that step succeeds)
but does not complete the OIDC→npm auth exchange, so the tarball `PUT`
goes out unauthenticated and npm returns 404. This publishes with the
**npm CLI** instead — upgraded to `>= 11.5.1`, which implements trusted
publishing correctly — while keeping pnpm for install/build.

It also adds a `workflow_dispatch` trigger (and lets the `publish` job
run on it), so the **already-tagged `4.0.0`** can be published without
waiting for a new release event.

After merge: run the workflow manually (Actions → Release Please → Run
workflow) to publish `4.0.0`; subsequent releases publish automatically.

If it still 404s with the npm CLI, the npmjs **trusted publisher**
registration doesn't match — verify it targets repo
`AlchemyCMS/alchemy-json_api` and workflow file `release-please.yml`.

Author: tvdeyen

.github/workflows/release-please.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
 permissions:
   contents: write
@@ -23,7 +24,7 @@ jobs:
 
   publish:
     needs: release-please
-    if: needs.release-please.outputs.release_created == 'true'
+    if: ${{ needs.release-please.outputs.release_created == 'true' || github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -38,11 +39,18 @@ jobs:
         with:
           node-version: "22"
           registry-url: "https://registry.npmjs.org"
+      # pnpm's OIDC trusted-publishing handshake is broken (pnpm/pnpm#11513),
+      # so publish with the npm CLI, which needs >= 11.5.1 for trusted publishing.
+      - name: Update npm for OIDC trusted publishing
+        run: npm install --global npm@latest
       - name: Install pnpm
         uses: pnpm/action-setup@v4
         with:
           version: 10.12.1
       - name: Install dependencies
         run: pnpm install
+      - name: Build
+        run: pnpm run build
+      # pnpm builds; npm only uploads (--ignore-scripts skips the prepare rebuild).
       - name: Publish to npm with provenance
-        run: pnpm publish --provenance --access public --no-git-checks
+        run: npm publish --provenance --access public --ignore-scripts