CI passes happily when npm package is outdated

Unfortunately the publish step is too permissive. If anything has changed about the NPM package since the last publish we want to stop a merge from happening until the author bumps the package version.