build: use npm ci instead of npm install in publish workflow