fix(ci): upgrade npm for OIDC trusted publishing (needs >= 11.5.1) (#51)

Node 22 bundles npm 10.x, which signs provenance but cannot perform the
trusted-publishing token exchange — every CI publish has failed with npm's
E404-on-PUT (force-release.yml has never had a successful run; 0.0.3 was
evidently published manually). Add 'npm install -g npm@latest' to both
release workflows before publishing.

Note: npmjs.com-side trusted-publisher config (package Settings → Publishing
access → GitHub Actions: taskade/mcp + workflow file) must also exist for
both packages — that part is a web-UI action for a package owner.

feat: add glama.json for Glama.ai ownership claim (#21)

Adds maintainer metadata for Glama.ai MCP server listing.
Fixes "Missing or invalid glama.json" score issue.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>