Force npm self-install in release workflow

[mishushakov]

Summary

• The release workflow's "Update npm" step was failing with `Cannot find module 'promise-retry'` when upgrading the npm bundled with Node 22 (10.x) to 11.6. This is a known npm self-install bug (failed run).
• Adding `--force` to `npm install -g npm@^11.6` works around the module-resolution failure during the self-overwrite.

Test plan

• Next run of the Release workflow reaches the "Install dependencies" step without erroring in "Update npm".

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Single-line CI workflow change affecting only the release pipeline; minimal code/runtime impact beyond how npm is upgraded in GitHub Actions.

Overview
Adjusts the Release GitHub Actions workflow to install npm@^11.6 with --force in the “Update npm” step, working around npm self-upgrade/module-resolution failures on Node 22 so the job can proceed to dependency installation and publishing.

^{Reviewed by Cursor Bugbot for commit b412935. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

LGTM — single-line workaround for the known npm self-install bug on Node 22.

Extended reasoning...

Overview

This PR modifies a single line in .github/workflows/release.yml: adding --force to the npm install -g npm@^11.6 command in the release job's "Update npm" step. No runtime code, tests, or application logic is touched.

Security risks

None. The --force flag here instructs npm to overwrite its own binary during a global self-upgrade, which is the documented workaround for the Cannot find module 'promise-retry' error that occurs when npm 10.x (bundled with Node 22) attempts to replace itself with npm 11.x. This does not bypass any authentication, expand permissions, or introduce injection risk.

Level of scrutiny

Low. This is a CI-only, single-line change fixing a known, reproducible npm breakage with a well-understood workaround. The change is isolated to the release pipeline and has no effect on the library code or its consumers.

Other factors

The bug report flags a pre-existing ::set-output deprecation in the charts-release job, which is unrelated to this PR's change. That issue has a masked impact (a fallback in build-docker-image compensates), so it does not block this merge — but it is worth fixing separately.