chore(release): prepare Nova v1.3.1

[papi-ux]

Summary

• bump Nova to versionName 1.3.1 and versionCode 33
• add v1.3.1 release notes to the main changelog, README latest-release block, and Fastlane changelog 33.txt
• advance the updater security fixture to the next hypothetical upgrade (1.3.2 / code 34)

Included since v1.3.0

• portable APK checksum sidecars that work with sha256sum -c from a clean directory
• NovaHUD Performance/Debug readability and true text-only 0% opacity
• complete three-digit Debug headline FPS rendering at compact Retroid widths
• Watch-stream eligibility and launch profile aligned to the live owner stream

Verification

• fail-on-error lintNonRoot_gameDebug
• testNonRoot_gameDebugUnitTest: 751 tests, 0 failures/errors
• Retroid smoke/native-submodule Python helpers: 51 tests, 0 failures
• all-ABI assembleNonRoot_gameRelease
• ARM64, ARMv7, and x86_64 release APKs all report com.papi.nova, version 1.3.1 / code 33
• focused post-commit NovaUpdateInstallerSecurityTest: 2/2 passed
• staged static/security scan clean
• independent Codex review found no actionable issues
• delegated review findings resolved: latest-release anchor updated and tagged-APK validation wording made explicitly pending

Remaining fail-closed release gates

This PR does not tag, publish, deploy, or release Nova. After merge, the final signed ARM64 candidate still needs package-identity and physical RP6 Library/preflight/stream/controller/Command Center/NovaHUD/cleanup proof. Physical Thor companion-display/controller validation remains required unless routing-only surrogate proof is explicitly accepted.