chore(ci): migrate CUA npm packages to trusted publishing

.github/workflows/cd-cua-driver.yml

@@ -803,14 +803,6 @@ jobs:
         with:
           name: 'cua-sdk-npm-${{ needs.validate-version.outputs.version }}'
           path: '${{ runner.temp }}/cua-sdk-package'
-      - name: 'Require npm publishing token'
-        env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'
-        run: |
-          if [[ -z "$NODE_AUTH_TOKEN" ]]; then
-            echo '::error::production-release NPM_TOKEN is required for the first @qwen-code/cua-sdk publication'
-            exit 1
-          fi
       - name: 'Clean-install against the published GitHub Release'
         env:
           QWEN_CUA_SDK_CACHE_DIR: '${{ runner.temp }}/public-release-cache'
@@ -864,7 +856,6 @@ jobs:
           '
       - name: 'Publish immutable SDK tarball'
         env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'
           VERSION: '${{ needs.validate-version.outputs.version }}'
         run: |
           set -euo pipefail
@@ -934,17 +925,8 @@ jobs:
           name: 'node-repl-mcp-npm-${{
             needs.validate-version.outputs.node_repl_version }}'
           path: '${{ runner.temp }}/node-repl-package'
-      - name: 'Require npm publishing token'
-        env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'
-        run: |
-          if [[ -z "$NODE_AUTH_TOKEN" ]]; then
-            echo '::error::production-release NPM_TOKEN is required for the first @qwen-code/node-repl-mcp publication'
-            exit 1
-          fi
       - name: 'Publish immutable Node REPL tarball'
         env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'
           VERSION: '${{ needs.validate-version.outputs.node_repl_version }}'
         run: |
           set -euo pipefail

scripts/tests/package-scripts.test.js

@@ -530,13 +530,27 @@ describe('package scripts', () => {
         'release-sdk',
         'Publish @qwen-code/sdk',
       ],
+      [
+        '.github/workflows/cd-cua-driver.yml',
+        'publish-sdk',
+        'Publish immutable SDK tarball',
+      ],
+      [
+        '.github/workflows/cd-cua-driver.yml',
+        'publish-node-repl',
+        'Publish immutable Node REPL tarball',
+      ],
       ['.github/workflows/cd-mobile-mcp.yml', 'build-and-publish', 'Publish'],
     ]) {
       const publishJob = getWorkflowJob(readWorkflow(workflowPath), jobName);
       const installStep = getWorkflowStep(publishJob, 'Install npm 11');
+      const publishStep = getWorkflowStep(publishJob, publishStepName);
       expect(installStep).toContain('npm install --global npm@11.19.0');
+      expect(publishJob).toContain("id-token: 'write'");
+      expect(publishStep).toContain('--provenance');
+      expect(publishJob).toContain("name: 'production-release'");
       expect(publishJob.indexOf(installStep)).toBeLessThan(
-        publishJob.indexOf(getWorkflowStep(publishJob, publishStepName)),
+        publishJob.indexOf(publishStep),
       );
     }
 
@@ -552,7 +566,9 @@ describe('package scripts', () => {
       'packages/channels/telegram',
       'packages/channels/wecom',
       'packages/channels/weixin',
+      'packages/cua-driver/typescript',
       'packages/mobile-mcp',
+      'packages/node-repl',
       'packages/sdk-typescript',
     ]) {
       const packageJson = JSON.parse(