doc: add policy for landing new npm releases

This change in policy sets clear terms for when / how npm releases
can be landed into master and how long they are expected to bake in the
ecosystem. This is to cover all release types of npm including semver-major
releases.

What Node.js releases the updates land into are at the discretion of the
release team.

PR-URL: #21594
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>

doc/guides/maintaining-npm.md

@@ -1,5 +1,19 @@
 # Maintaining npm in Node.js
 
+New pull requests should be opened when a "next" version of npm has
+been released. Once the "next" version has been promoted to "latest"
+the PR should be updated as necessary.
+
+Two weeks after the "latest" release has been promoted it can land on master
+assuming no major regressions are found. There are no additional constraints
+for Semver-Major releases.
+
+The specific Node.js release streams the new version will be able to land into
+are at the discretion of the release and LTS teams.
+
+This process only covers full updates to new versions of npm. Cherry-picked
+changes can be reviewed and landed via the normal consensus seeking process.
+
 ## Step 1: Clone npm
 
 ```console