chore(release): prepare v1.6.0

[Cmochance]

Version bump 1.5.11 → 1.6.0 + CHANGELOG finalization + bilingual release notes for the v1.6.0 draft release (covers #51 ChatGPT.app merge adaptation, #52 quota backfill fix, and the identity-guard write-back).

# Codex Switch v1.6.0

## 中文

### 账号切换可靠性修复:串号、ChatGPT.app 合并、额度回滚

本版本修复切换链路三类问题:写回盲信 `.current_profile` 标记,账号漂移后被写进错误档案(串号);Codex 并入 `ChatGPT.app` 后按名称探测失效,健康安装报 `REAL_CODEX_NOT_FOUND`;额度回填用切入时冻结的根 `profile.json` 快照覆盖已刷新数据,额度反复回滚。

本版本改动:

- 写回目标按账号身份校验(`tokens.account_id` 与 id_token `email` 双识别),漂移账号路由到真正拥有者;未管理账号清标记并在面板提示
- 适配 `ChatGPT.app` 合并:发现与退出按稳定 bundle id `com.openai.codex`,`ChatGPT.app` 优先、`Codex.app` 兜底,候选须内嵌 codex CLI
- 进程信号先做 PID 归属校验,不误杀消费级 ChatGPT(`com.openai.chat`);AppleScript 退出不再同步等待(TCC 弹窗不再挂起切换),退出后取消 pending 事件
- 每次写回(切换、启动、关窗、重登)前刷新根 `profile.json` 并折算 live 用量,冻结快照不再回滚;元数据损坏时写回响亮失败而非清空卡片
- live 会话按激活时间(`activated_at`)归属,上一账号用量不再串显/串存;切换完成即触发静默额度刷新

### 验证

- `cargo test --lib`(137 通过,含回滚/归属/激活过滤回归用例)
- `npx tsc --noEmit` / `cargo fmt --all -- --check`
- `cargo run --example live_chatgpt_merge_check`

## English

### Reliability fixes: cross-contamination, the ChatGPT.app merge, quota rollback

This release fixes three switching-pipeline defects: the write-back trusted the `.current_profile` marker blindly, so a drifted live account overwrote the wrong profile; the Codex merge into `ChatGPT.app` broke name-based probes, reporting `REAL_CODEX_NOT_FOUND` on healthy installs; and the quota backfill kept copying the switch-in-frozen root `profile.json` snapshot over refreshed data, rolling quotas back.

Changes in this release:

- Write-back targets are identity-verified (matching `tokens.account_id` and the id_token `email`); a drifted account routes to its real owner, an unmanaged one clears the stale marker with a prompt
- The `ChatGPT.app` merge: discovery and lifecycle key off the stable bundle id `com.openai.codex`, preferring `ChatGPT.app` with `Codex.app` fallback; candidates must embed the codex CLI
- Process signalling verifies each PID's bundle first — the consumer ChatGPT client (`com.openai.chat`) is never killed by a name match; the AppleScript quit is no longer awaited (TCC prompts cannot hang a switch) and is cancelled after exit
- Every write-back (switch, launch, window close, re-login) refreshes the root `profile.json` and folds live usage first; corrupt metadata fails loudly instead of blanking the card
- Live sessions are attributed by activation time (`activated_at`), so a previous account's usage is no longer shown or persisted; each switch kicks an immediate silent quota refresh

### Verification

- `cargo test --lib` (137 passed, incl. rollback / attribution / activation-scoping regressions)
- `npx tsc --noEmit` / `cargo fmt --all -- --check`
- `cargo run --example live_chatgpt_merge_check`

🤖 Generated with Claude Code