release(chore): prepare 1.3.1 with the notarised menu-bar DMG

[Ducksss]

Summary

Prepares 1.3.1, the first release with the notarised menu-bar DMG attached. This is the same file set as the 1.3.0 prep (#77): the tracked version in the CLI, npm, AUR (with a new CLI checksum), docs, welcome.svg and the companion's Info.plist, plus a dated ## 1.3.1 CHANGELOG section. README, the site and llms.txt now point to the DMG on the latest release instead of saying there is no download.

Stacked on #89. Retarget to main after that merges.

⚠️ Merge only right before the live dispatch

• README and the site link to a DMG that only exists once v1.3.1 is published.
• Between this merge and the v1.3.1 tag, any PR that touches bin/codex-profile fails the AUR and metadata packaging tests.
• If the release happens after 2026-10-13, re-date the six release dates: the CHANGELOG heading, docs/index.html dateModified and footer, the docs/llms.txt release line, and both docs/sitemap.xml lastmod entries.

Release checklist

1. Apple Developer enrolment, Developer ID certificate and API key, then the five MENU_APP_* release secrets (see macos/README.md).
2. Re-date if needed, then merge this PR. A dry run needs 1.3.1 to be the tracked version on main, so the merge comes first.
3. Release dry run with version: 1.3.1 and menu_dmg: true. The DMG job must report an Accepted notarisation.
4. Live dispatch with the same version and a desktop_smoke_attestation, ideally right after the dry run so the README's download link isn't broken for long.
5. Test the downloaded DMG on a clean Mac, then add the Homebrew cask.

Test plan

• metadata-test.sh, aur-test.mjs, geo-test.mjs and the npm package smoke test pass at 1.3.1
• make check in CI

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[Ducksss]

Closing: 1.3.1 is on hold until there is a Developer ID for the notarised DMG (#89 is parked). The branch is kept; redo the prep with current dates when the release happens.