chore(release): update version to 2.3.22

[NathanFlurry]

• Update public release versions to 2.3.22.
• Carry forward npm trusted publishing checks and Windows build fixes from the previous release.

[railway-app]

🚅 Deployed to the rivet-pr-5815 environment in rivet-frontend

Service	Status	Web	Updated
kitchen-sink	😴 Sleeping (View Logs)	Web	Oct 2, 2026 at 1:02 am UTC
website	❌ Build Failed (View Logs)	Web	Oct 2, 2026 at 12:52 am UTC
frontend-cloud	😴 Sleeping (View Logs)	Web	Oct 2, 2026 at 12:42 am UTC
frontend-inspector	😴 Sleeping (View Logs)	Web	Oct 2, 2026 at 12:40 am UTC
ladle	✅ Success (View Logs)	Web	Oct 2, 2026 at 12:31 am UTC
mcp-hub	✅ Success (View Logs)	Web	Oct 2, 2026 at 12:30 am UTC

[claude]

Review: release 2.3.22

This is a mechanical version bump (2.3.20 to 2.3.22) plus a few CI and Docker fixes. I found no blocking issues.

Workflow (publish.yaml)

• Adding id-token: write with contents: read is the right least-privilege setup for npm trusted publishing.
• The check-npm-oidc step runs only on release triggers, so it fails fast before any publishing starts.
• The post-publish step deletes the :_authToken= line from NPM_CONFIG_USERCONFIG and unsets NODE_AUTH_TOKEN. The OIDC availability check then fails loudly if the token env vars are missing. Both are good changes.
• Pinning node-version to 24.20.0 is reasonable, since trusted publishing needs a recent npm. Consider adding a comment that says why it is pinned, so nobody loosens it back to 24 later.
• The sed -i is guarded by a file-exists check, which is fine.

Docker (windows-x64.Dockerfile)

• Installing nasm for aws-lc-sys cross-compilation is correct. It uses --no-install-recommends and cleans the apt lists.

Version bump

• Spot checks showed consistent changes across the Cargo.toml workspace deps, the examples, and the package manifests.
• Before merging, confirm that no file still references 2.3.20 or 2.3.21. For example: git grep -nE '2\.3\.(19|20|21)' -- ':!pnpm-lock.yaml'.
• Cargo.lock was at 2.3.19 while Cargo.toml was at 2.3.20 before this PR. Make sure the lockfile now matches 2.3.22 and that cargo check --locked passes.

Conventions and tests

• No new code needs test coverage. The release run itself will exercise the OIDC changes.
• Per CLAUDE.md, the release should be cut with --version 2.3.22 --latest.

LGTM.