v3.42.3

## Fixes

- **hooks**: quote-aware split for `RUFLO_HOOK_CLI_OVERRIDE` (#3344) — the test-only CLI-override parser in `plugins/ruflo-core/scripts/ruflo-hook.cjs` did a naive `.split(' ')`, which broke `process.execPath` into `C:\Program` plus stray tokens on a standard Windows Node install (`C:\Program Files\nodejs\node.exe`). Found while verifying #3332's Windows argv fix on a real Windows machine rather than `windows-latest` CI (whose hosted Node path has no space). No production impact — `RUFLO_HOOK_CLI_OVERRIDE` is never set outside the test harness.
- **release**: spawn `npm.cmd` with `shell:true` on Windows (#3346, #3348) — `scripts/stage-internal-runtime-bundles.mjs` and `scripts/prepare-root-publish.mjs` both spawned `npm.cmd` directly without `shell:true`, which throws `EINVAL` on any current Node/Windows combo (CreateProcess can't launch a `.cmd`, and Node has refused to shell out to one implicitly since CVE-2024-27980). This blocked every Windows publish of `@claude-flow/cli` and the `claude-flow` umbrella package. Found live while publishing this release from a Windows machine.

## Verification

- `plugins/ruflo-core/scripts/test-hooks.mjs`: 32/32 (was 29/32 before #3344)
- `v3/@claude-flow/cli/__tests__/ruflo-hook-windows-argv.test.ts`, `escape-cmd-arg.test.cjs`, `mcp-launch.test.cjs`, `scripts/smoke-ruflo-hook-cjs.mjs`, cross-platform/env-var audits: all clean
- Full Windows publish pipeline (`@claude-flow/cli` → `claude-flow` → `ruflo`) exercised end-to-end on a real Windows machine after the fixes landed
- `latest` / `alpha` / `v3alpha` dist-tags verified aligned at 3.42.3 across all three packages

🤖 Generated with [RuFlo](https://github.com/ruvnet/ruflo)