fix(ci): pin upload-artifact to v7 in npm publish workflow (#181)

The release-build job in publish-npm.yml referenced
actions/upload-artifact@v8, which does not exist (upload-artifact's
latest major is v7; only download-artifact has a v8). This made the
first npm release fail at the "Getting action download info" stage
with "Unable to resolve action actions/upload-artifact@v8".

Every other upload-artifact reference in the repo already uses v7;
align this one. download-artifact@v8 (line 158) is valid and left
unchanged.

Co-authored-by: Claude <noreply@anthropic.com>

Author: punitarani

.github/workflows/publish-npm.yml

@@ -125,7 +125,7 @@ jobs:
         run: npm pack
 
       - name: Upload tarball
-        uses: actions/upload-artifact@v8
+        uses: actions/upload-artifact@v7
         with:
           name: npm-tarball
           path: fli-js/*.tgz