Disable setup-node package manager cache in publish job

Fixes zizmor cache-poisoning finding surfaced by Super-Linter.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B4uAX78vP2cYisKwLmZgSP

Author: claude

.github/workflows/publish.yml

@@ -22,6 +22,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
+          package-manager-cache: false
           registry-url: 'https://registry.npmjs.org'
 
       - name: 📥 Download deps