fix(ci): [MEDIUM] pin npm in privileged workflows

Replace npm@latest with a content-pinned npm@12.0.2 tarball (hardcoded
sha512 integrity) in publish and API-reference deploy workflows, then
assert the global npm on PATH matches that install.

Co-authored-by: Mike Hardy <github@mikehardy.net>