🐛 fix: use Corepack to upgrade npm on the publish runner

[gabrieldejesusrodrigues]

Summary

• Replace npm install -g npm@latest with Corepack (corepack enable && corepack prepare npm@latest --activate) in the Upgrade NPM step of the publish-npm job.

Why

The v0.2.2 release run failed at the Upgrade NPM step with:

npm error code MODULE_NOT_FOUND
npm error Cannot find module 'promise-retry'

This is a known bug in the GitHub Actions runner toolcache — Node 22.22.2 ships there with a broken npm 10.9.7 missing the promise-retry module from its own dependency tree. Any npm install -g npm@latest triggers @npmcli/arborist, which needs promise-retry, and crashes before the upgrade completes.

Failing run: https://github.com/wave-telecom/wave-tech-framework/actions/runs/25140740088/job/73689655205

Reference: actions/runner-images#13883, npm/cli#9151.

Corepack is bundled with Node 22 and lives outside npm's broken module tree, so it can install npm@latest cleanly.

Test plan

• After merge, cut v0.2.3 and confirm the publish-npm job succeeds.
• Verify the new version appears on https://www.npmjs.com/package/@wave-tech/framework.

🤖 Generated with Claude Code

[leandrojo]

Codex local PR review

Reviewed by a Codex agent on my behalf. This is still in testing.

• blocking: .github/workflows/npm-publish.yml
  corepack enable does not enable the npm shim by default, so the following npm publish --provenance still resolves to the runner’s bundled global npm. That means this can leave the publish job on the same broken npm installation the PR is trying to avoid, and a release can still fail or publish with the wrong npm version. Node’s Corepack docs call out that npm shims are not enabled by default: https://nodejs.org/download/release/v22.10.0/docs/api/corepack.html#how-does-corepack-interact-with-npm
  Smallest fix: explicitly enable the npm shim before publishing, for example:

  corepack enable npm
  corepack prepare npm@latest --activate
  npm --version

Residual risk: I could not execute the GitHub Actions runner environment locally, so the remaining validation is a release workflow run after the shim fix.