Sync upstream release metadata tail

[ColumbusLabs]

Upstream range

Syncs the live upstream tail from 261bad662bc9157f8a5e4e48269cd3642ab4c612 to 61ff93208c2f2570e1bcb5487473b0419cc85d49.

This is the two-commit tail that appeared after PR #47 was already in flight:

• 913b1a641 docs: update appcast for 0.38.0
• 61ff93208 chore: start 0.38.1 development

Risk review

Low risk release metadata only: upstream CHANGELOG.md, appcast.xml, and version.env.

QuotaKit adaptations

• Preserved QuotaKit appcast ownership and did not import upstream CodexBar release feed entries.
• Preserved QuotaKit marketing/build/mobile versions and UPSTREAM_VERSION.
• Advanced UPSTREAM_MONITOR_BASE to 61ff93208c2f2570e1bcb5487473b0419cc85d49 so the monitor does not reopen this reviewed tail.
• Added a QuotaKit changelog note for the reviewed release-metadata tail.

Validation

• git diff --cached --check
• Conflict-marker check over CHANGELOG.md, appcast.xml, and version.env