fix(mobile-mcp): align CD workflow with release.yml npm auth (add scope, drop provenance) (#6257)

.github/workflows/cd-mobile-mcp.yml

@@ -14,20 +14,21 @@ on:
         type: 'boolean'
         default: true
 
-permissions:
-  contents: 'read'
-  id-token: 'write'
-
 jobs:
   build-and-publish:
     runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'read'
     steps:
       - uses: 'actions/checkout@v4'
 
       - uses: 'actions/setup-node@v5'
         with:
-          node-version: '22'
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: 'package-lock.json'
           registry-url: 'https://registry.npmjs.org'
+          scope: '@qwen-code'
 
       - name: 'Determine version'
         id: 'version'
@@ -58,6 +59,6 @@ jobs:
       - name: 'Publish'
         if: '${{ !inputs.dry_run }}'
         working-directory: 'packages/mobile-mcp'
-        run: 'npm publish --access public --provenance'
+        run: 'npm publish --access public'
         env:
           NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'