v3.12.2

## Bundled fixes

### #2407 — daemon proliferation → kernel panic (CRITICAL)
Atomic O_EXCL lockfile in `daemon.ts` + dropped the shell `&` in `init.ts:424`. Race test verified: 5 concurrent `daemon start` → 1 surviving daemon (was 3-5+).

One real incident accumulated **39 zombie daemons holding ~8.5 GiB** and contributed to a macOS kernel panic on June 15. No longer possible.

### #2403 — `security cve` no longer a stub
Now delegates to `npm audit --json` (same GitHub Advisory DB source as `security scan`), extracts CVE IDs from `via` titles/URLs, supports `--check CVE-XXXX-NNNN` and `--severity {critical,high,medium,low}` filters. Local verify on this repo: 37 affected packages surfaced.

### #2397 — `.claude/helpers/*` hooks hardening
Community contribution from @tjaiyen — 5 grounded bug fixes including real timeout via `Promise.race` (not the spurious "timer cleared on sync return" pattern), signal cleanup, truncation transparency, cross-platform slug normalization. 248+/49− across 8 files.

### Dependabot bumps (3/5 merged cleanly)
- `@types/node` 20.19.41 → 20.19.43 in `/v3/@claude-flow/browser`
- `vitest` 4.1.6 → 4.1.9 in `/v3/@claude-flow/browser` + `/plugins/ruflo-graph-intelligence`
- `agent-browser` 0.27.0 → 0.27.3 in `/v3/@claude-flow/browser`

(#2384 + #2386 had merge conflicts; dependabot will rebase.)

## Install

```bash
npx ruflo@3.12.2
# or
npm i ruflo@latest
```

## Compatibility

All 3 packages × 3 dist-tags published in lockstep:
- `@claude-flow/cli@3.12.2` — latest, alpha, v3alpha
- `claude-flow@3.12.2` — latest, alpha, v3alpha
- `ruflo@3.12.2` — latest, alpha, v3alpha

No API breaking changes. Patch bump per CLAUDE.md publishing policy.

🤖 Generated with [RuFlo](https://github.com/ruvnet/ruflo)