ci: fix OIDC npm publish (npm >= 11.5.1); run CI on PRs only

[designcode]

What

Fixes the npm publish failure on the first Changesets release, and trims CI triggers.

The publish bug

The 3.4.0 release job failed with:

npm error 404 Not Found - PUT https://registry.npmjs.org/@tigrisdata%2fcli
'@tigrisdata/cli@3.4.0' is not in this registry.

…even though provenance was signed just before. Root cause: changeset publish shells out to npm publish, and the runner (node 22) bundles npm ~10.9. npm can sign provenance since 9.5, but OIDC trusted publishing — authenticating npm publish with no token — requires npm ≥ 11.5.1. So the publish request was effectively unauthenticated and the registry returned a 404 for the scoped package. @semantic-release/npm worked before because it runs its own OIDC token exchange, independent of the npm CLI version.

Fix: npm install -g npm@latest before publishing, in both the release and beta jobs.

CI trigger change

ci.yaml now runs on pull_request → main only (drops the push trigger and the next branch). release.yaml already runs the integration suite on push to main (gated to the publish push), so this removes the duplicate run.

🤖 Generated with Claude Code

---

Note

Medium Risk
Publish path changes affect production npm releases; CI no longer runs on every push, and ci.yaml integration may only run via manual dispatch unless release gating covers it.

Overview
Release publishing now runs npm install -g npm@11 in the stable release and manual beta jobs before changeset publish, so npm publish can use OIDC trusted publishing (npm ≥ 11.5.1). Node 22’s bundled npm ~10.9 could sign provenance but not authenticate the publish, which led to failed scoped-package publishes.

CI triggers in ci.yaml are narrowed to pull_request against main (plus workflow_dispatch); push and the next branch are removed. Quote style for Node 22 is normalized to double quotes.

Note: the integration job in ci.yaml still only runs on push or workflow_dispatch, so it no longer runs on ordinary PRs—integration coverage on merge-to-main is expected via the pre-publish gate in release.yaml when there are no pending changesets.

^{Reviewed by Cursor Bugbot for commit b3da070. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2508be5. Configure here.}