Prepare CUA package releases

[rgarcia]

Summary

• bump @onkernel/cua-ai to 0.6.0
• bump @onkernel/cua-agent to 0.6.0 and pin @onkernel/cua-ai@0.6.0
• bump @onkernel/cua-cli to 0.4.0 and pin both CUA libraries at 0.6.0
• add AI and Agent changelog entries for response-threading, retry, image-context, and exact-empty recovery changes
• update the workspace lockfile

After merge, publish sequentially from the same commit: AI, then Agent, then CLI. Each dependent tag waits for the prior package to become available on npm.

Testing

• npm run build --workspace @onkernel/cua-ai
• env -u GOOGLE_API_KEY -u GEMINI_API_KEY npm test --workspace @onkernel/cua-ai (142 passed)
• npm run build --workspace @onkernel/cua-agent
• npm run typecheck --workspace @onkernel/cua-agent
• npm test --workspace @onkernel/cua-agent -- --exclude '**/*.live.test.ts' (160 passed)
• npm run build --workspace @onkernel/ptywright
• PTYWRIGHT_REQUIRED=1 npm test --workspace @onkernel/cua-cli (92 passed)
• packed and installed all three release tarballs in a clean project
• ESM import smoke tests for AI and Agent
• installed cua --help smoke test

---

Note

Low Risk
Release-only version and documentation updates with no runtime code changes in the PR diff.

Overview
Prepares a coordinated npm release by bumping @onkernel/cua-ai to 0.6.0, @onkernel/cua-agent to 0.6.0 (pinned on AI 0.6.0), and @onkernel/cua-cli to 0.4.0 (pinned on both libraries at 0.6.0), with matching package-lock.json workspace entries.

Adds 0.6.0 changelog notes that document behavior already in the tree: AI’s breaking move from CUA_DISABLE_RESPONSE_THREADING to per-request disableResponseThreading / agent responseThreading; agent opt-in retry, default toolResultImageReplayLimit, responseThreading, and emptyResponseRecovery. No application source changes in this diff—release metadata only.

^{Reviewed by Cursor Bugbot for commit 6c35a7e. Bugbot is set up for automated code reviews on this repo. Configure here.}