chore(release): prepare v1.3.1

[lelelelelelelelelelelelele]

Summary

• Prepare codexU v1.3.1 as the next release after v1.3.0; once published, v1.3.1 becomes the latest release while the existing v1.3.0 release remains immutable.
• Include the accepted CODEXU-010 Windows fix: codex.exe app-server children use CREATE_NO_WINDOW, so first open and Refresh do not create a CMD window while the existing quota-read and child-cleanup behavior remains intact.
• Add a practical Windows installation guide to windows/README.md: open the latest GitHub Release, download the -setup.exe NSIS package, and install for the current user. MSI and .sha256 files remain documented as alternatives.
• Update the v1.3.1 changelog and release notes with the fix and the newly generated Windows package checksums.

Validation

• Global memory-risk gate: PASS via scripts/check-memory-risks.sh from Git Bash; the repository make command is unavailable on this Windows host.
• Windows release build from this PR branch: PASS — pinned Rust fmt, full Windows workspace tests, Web build, Tauri x86_64 MSI/NSIS bundles, manifest, and SHA-256 generation.
• CODEXU-010 focused regression: PASS — the real console-capable child reported GetConsoleWindow() = 0.
• Accepted candidate smoke test: PASS — real codexU Windows release launch and Refresh showed no CMD/console popup.
• Current Windows package checksums:
  • MSI: d511898277bdc20d77d321ce34d3c381cf7336b0440077c08da68eea2a79ea7d
  • NSIS: 9f5d2673faa091247233c60e7cde247ca5fe3b484bc8721960b53c24ae731415

Release boundary

• This PR updates the release-preparation branch; no v1.3.1 tag or public GitHub Release exists yet.
• After merge, the macOS arm64/x86_64 artifacts and their checksums still need the repository release workflow, followed by the explicit v1.3.1 tag and GitHub Release publication.
• The release remains unsigned by the repository default workflow: no Windows code signing or Apple notarization is claimed.