v3.54.1

Ruflo 3.54.1 is a fixes release: `@claude-flow/cli`, `claude-flow` and `ruflo` all at 3.54.1. `@claude-flow/shared` 3.0.1 was published first.

## Fixes (npm packages)
- #3851: piped output (`ruflo ... | consumer`) is no longer cut at 64 KiB. stdio is made blocking for pipes. Not tested on Windows.
- #3845: `session export --compress` now writes real gzip, and import detects it by magic bytes. Thanks @rudycelekli (PR #3848).
- #3840: YAML export preserves saved values. Thanks @rudycelekli (PR #3842).
- #3853: retry jitter is clamped to maxDelayMs.
- #3855: monitoring metrics expire by retention on read.
- #3841: WorkerQueue shutdown clears retry timers.
- #3844: hermetic statusline test.
- #3856: rate-limiter stats labels corrected.
- #3859: Porter stemmer step 4 uses the longest suffix. This changes stems for words like "document", so persisted BM25 indexes should be rebuilt.
- #3863: git workspace identity keeps trailing whitespace in path names.
- #3865: EventStore returns null for a missing snapshot (`@claude-flow/shared` 3.0.1, published first).
- #3691: `agentdb_pattern-store` and the bridge no longer acknowledge failed writes.
- #3693: the graph writer opens SQLite through the better-sqlite3 copy that agentdb resolves, so sidecars of a live AgentDB handle are no longer deleted.

Not fixed here: #3692 (covered by open PR #3831). Other read-write opens through the CLI's own better-sqlite3 copy (memory-distillation.ts, memory-backup.ts, distill-tuning.ts) could repeat the #3693 hazard; tracked for a follow-up.

## Plugins (git marketplace, not the npm tarballs)
ruflo-mods fixes (#3791 root-delete guard: backticks, `$'...'` escapes, abbreviated long options; #3793, #3795, #3798, #3801, #3803, #3805) and console security fixes (#3814, #3815, #3817, #3818 and part of #3816) reach you through the plugin marketplace:

    claude plugin marketplace update ruflo
    claude plugin update ruflo-console@ruflo
    claude plugin update ruflo-mods@ruflo

Then restart Claude Code.

Console 0.36.0 adds Events and Timeline pages with persistent history in `.claude-flow/console/` (`eventsPersist` option; local only). `ruflo init` now ignores `console/`.

## Known limits
- The recall-log from 3.54.0 is on by default (opt out with `RUFLO_RECALL_LOG=0`).
- Open lows from the Events review: rotation drops the older half, two consoles can overshoot the 2 MiB cap, and forget keeps pins and rules.
- CI timing tests were made robust (#3876) and a racy mock-ordering test fixed (#3881).
- #3802's wider risky-call set needs a maintainer decision.