feat(cli): refresh approval fallback page (#3431)

## Summary
- Refresh the browser fallback tool-approval page with the Composio CLI
landing page visual language: light dithered background, mono terminal
card, and brand-blue actions.
- Serve the approval HTML directly from the temporary `127.0.0.1`
callback server instead of writing/opening a `file://` page, so approval
buttons call back to the active CLI process with relative local routes.
- Keep the native macOS sidecar as the preferred prompt when available;
the browser prompt remains the fallback when the sidecar is missing or
fails before returning a decision.
- Add a CLI patch changeset.

## Tests
- `pnpm exec eslint ts/packages/cli/src/services/tool-permissions.ts`
- `pnpm --filter @composio/cli typecheck:src`
- `git diff --check`

## Notes
- Initially `typecheck:src` failed before workspace package build
artifacts existed in the fresh worktree; after building required
workspace dependencies it passed.

---------

Co-authored-by: Malay Vasa <malayvasa@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs(py): add 0.13.1 entry to CHANGELOG (#3427)

Adds a `0.13.1` entry to `python/CHANGELOG.md` covering the changes
accumulated on `next` since the last Python release (`py@0.13.0`, May
7).

The CHANGELOG had been quietly abandoned since `0.8.11` (Sept 2025);
rather than try to backfill the 4-minor gap, this PR draws a line and
adds a banner pointing readers at the git log for that window. Future
releases start fresh from here.

## What's in 0.13.1

- **SHARED connected accounts (experimental)** —
`composio.experimental.update_acl`, `experimental={...}` on `link()` /
`session.authorize()`, `account_type` filter on `list()`. Mirrors
`@composio/core@0.10.0` shipping in #3425.
- **`initiate()` deprecation warning** — gated on response `Deprecation`
header (RFC 9745) instead of `auth_scheme`, eliminating false positives
for custom auth configs and non-OAuth schemes.
- **Schema converter** — preserves nullability on `null`-only `anyOf`
blocks.
- **Dep bump** — `composio-client` 1.36.0 → 1.39.0.

## Release plan

Documentation only — does NOT trigger a release on its own. The Python
release flow is tag-triggered:

```bash
# After this PR merges and after #3425 ships:
git tag py@0.13.1 <next HEAD sha>
git push origin py@0.13.1
```

That fires `.github/workflows/py.release.yml` which builds and publishes
to PyPI.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>

feat(cli): support `composio upgrade <version>` for specific releases (…

…#3428)

## Summary

- `composio upgrade` now accepts an optional `<version>` argument so
users can install any published CLI release — stable or beta — without
having to wait for the channel pointer to move.
- Accepts `0.13.1`, `v0.13.1`, `0.13.1-beta.42`, or the full
`@composio/cli@0.13.1` tag (normalized internally).
- When a version is provided, the "already on latest" guard is skipped
so the command also supports downgrades and reinstalls. `--beta`
continues to control the no-arg case.

## Examples

```bash
composio upgrade                       # latest stable (unchanged)
composio upgrade --beta                # latest beta (unchanged)
composio upgrade 0.13.1                # pin to a specific stable
composio upgrade 0.13.1-beta.42        # install a specific beta
composio upgrade @composio/cli@0.13.1  # full release tag also accepted
```

## Implementation

- `upgrade.cmd.ts`: added optional `version` Args, normalizes input to a
`@composio/cli@<semver>` release tag, passes it through to the service.
- `upgrade-binary.ts`: `upgrade`/`fetchLatestRelease` now accept a `tag`
option that fetches the GitHub release directly via
`/releases/tags/<tag>`, bypassing the channel resolver. When a tag is
explicit, the update-availability check is skipped.
- Falls back to the explicit tag for `installSkillSafe` when the upgrade
completes without returning one.

## Test plan

- [x] `pnpm typecheck` (CLI package) — clean
- [x] `pnpm test` in `ts/packages/cli` — 703 passed, 1 skipped, no
regressions in `upgrade-binary.test.ts`
- [ ] Manual: `composio upgrade 0.13.0` from a newer beta to confirm
downgrade path works against real GitHub releases
- [ ] Manual: `composio upgrade --beta` still resolves the latest beta
when no version is given

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>