ci(publish): build on Node 22 — npm@latest (12.x) refuses to install on Node 20

npm 12 declares engines ^22.22.2 || ^24.15.0 || >=26.0.0. The workflow pinned
node-version 20 and then ran 'npm install -g npm@latest', so the engine check
would fail and the publish step would never run — with the GitHub Release
already public and the tag burnt. Caught before the first tag exists.

Package engines (node >=18) unchanged; this pins the build runner only.

.github/workflows/publish.yml

@@ -27,9 +27,15 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      # Node 22, not 20: the upgrade step below pulls npm@latest, and npm 12
+      # declares engines node ^22.22.2 || ^24.15.0 || >=26. On Node 20 that
+      # install fails the engine check and the publish step never runs — after
+      # the GitHub Release is already public. The published package itself
+      # still supports Node >=18 (mcp-server/package.json engines); this pins
+      # only the build runner.
       - uses: actions/setup-node@v7
         with:
-          node-version: '20'
+          node-version: '22'
           registry-url: 'https://registry.npmjs.org'
 
       # Trusted Publishing + provenance require npm >= 11.5.1