Prepare Win-CodexBar 0.48.0

[Finesssee]

Summary

Release-prep for Win-CodexBar 0.48.0 (2026-08-09), following the 0.47.0 precedent (2d0a23f). Exactly seven files:

• rust/Cargo.toml, apps/desktop-tauri/src-tauri/Cargo.toml, apps/desktop-tauri/package.json, apps/desktop-tauri/src-tauri/tauri.conf.json: version 0.47.0 → 0.48.0
• version.env: MARKETING_VERSION=0.48.0, BUILD_NUMBER=89 → 90
• Cargo.lock: workspace package version entries regenerated (codexbar, codexbar-desktop-tauri; no dependency changes)
• CHANGELOG.md: new ## [Windows] 0.48.0 - 2026-08-09 section

No tag, release build, or Winget action in this PR.

Changelog coverage (since v0.47.0)

• Added: CodeBuddy CN credit usage (feat(providers): add CodeBuddy CN credit usage provider #269); multi-account Codex management + tray switching (feat(codex): port multi-account Codex domain core (PR 1/5) #255–feat(codex): add tray menu flyout for Codex accounts (PR 5/5) #260); upstream 0.48.0 functionality (Port upstream 0.48.0 updates #271) — serve dashboard, unified Pi-family (pi + OMP) agent sessions with --json-v2/SSH fallback, Copilot AI credits, CommandCode GOAT, OpenRouter key meter, ZoomMate cookie scope, OpenCode Go per-model daily costs, Kimi/GLM/z.ai China regional routing.
• Fixed: Codex weekly window detection (Fix Codex weekly window detection #268); MiniMax CN token-plan fetch (MiniMax CN active Token Plan not detected in v0.47.0 (legacy remains endpoint returns 2062) #254, Fix MiniMax CN Token Plan web fetch with token-plan endpoints (#254) #262); tray zoom/clamp (Tray layout: zoom<->auto-fit scrollHeight mismatch (tall cards clipped at zoom >100%) + proof-harness anchor overflow #265, fix(tray): scale auto-fit measure by active zoom + clamp proof anchor (#265) #266) + accounts card polish (fix(codex): polish accounts card overflow and weekly-only tray bar #264); fractional-DPI tray-flyout oscillation ([Bug]: Pop-up resizing glitch on Codex tab #261, fix(tray): stop fractional-DPI tray-flyout resize oscillation via two-state cycle detection (#261) #272).
• Changed: interaction-guard relaxation (Relax interaction guard: 14-day age, 15 PRs per 7-day window #263); SignPath code-signing policy + privacy docs — signing pending onboarding, artifacts remain unsigned with SHA-256 sidecars (docs: clarify SignPath code signing is pending, not yet implemented #270). No claim of implemented signing.

Validation (local, Windows)

• scripts/local-check.ps1 -All -Version 0.48.0: fmt ✓, clippy -D warnings both manifests ✓, shared rust tests 1205/1206 — one failure in cli::tty_runner::tests::test_run_sends_script_through_pty diagnosed as host-environment ConPTY flake on Windows 10 19045 (test re-runs green in isolation; identical code+tests green on hosted CI at base b455a5e); then abort per fail-fast.
• Remaining phases completed manually here: Tauri tests 341/341 ✓, frontend tests 246/246 ✓, frontend build (tsc+vite) ✓.
• scripts/release-doctor.ps1 -Version 0.48.0: all five version pins + CHANGELOG entry ✓ (tag/asset checks intentionally fail — no tag or build artifacts exist yet by design).
• Scope: exactly the seven files; git diff --check clean; staged file list inspected before commit.

Merge order: this PR lands, then tag v0.48.0, then release-doctor + windows-release-build.ps1 -Ref v0.48.0 -SmokeInstall, then upload + Winget.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}