ci: fix release flow order and drop broken npm upgrade step

[rafa-stacks]

Description

Fixes the release workflow (.github/workflows/release.yml), which failed during the publish-npm step.

1. Drop the broken Upgrade npm step. The publish-npm job ran npm install -g npm@latest before publishing. Recent npm@latest ships a global install missing the bundled sigstore module that npm publish --provenance requires at runtime, so the publish died with:

npm error code MODULE_NOT_FOUND
npm error Cannot find module 'sigstore'
npm error - .../libnpmpublish/lib/provenance.js

Rerunning was deterministic — same failure every time. The npm bundled with Node 24 (per .nvmrc) is already provenance-capable, so the manual upgrade was both unnecessary and the cause of the break. Removed it.

2. Run the release jobs sequentially. Previously publish-npm, publish-docker, and github-release ran as independent parallel jobs, so a GitHub release could be cut even if the docker/npm publishes failed. They now chain via needs::

publish-docker → publish-npm → github-release

so the release is only created after both artifacts publish successfully.

Breaking change?

No. CI-only change; no application code or public API affected.

Checklist

• All tests pass
• Tests added in this PR (if applicable)

_{🤖 Generated with Claude Code}