v3.26.0

## Highlights

- **Agent-Native Versioning (ANV) — Phase 1.** `ruflo version --explain` now reports an advisory
  `+ad.<n>.g<sha>.cat<generation>[.hal<tier>]` suffix alongside the normal semver, backed by a new
  `catalog-manifest.json` with real, git-measured counts (currently 164 agent types, 387 MCP tools,
  34 skills) — never fabricated numbers, and no benchmark tier claimed without a real signed GAIA/HAL
  submission. Plain `ruflo --version`/`-V` and bare `ruflo version` are unaffected (still plain semver,
  npm-range-safe build metadata). `ruflo version --require-catalog-gte N` gives scripts a capability
  gate. See the [ANV proposal](https://gist.github.com/ruvnet/0d858ad440a4439b4a2281a40c39b1a0).
- **Statusline promo disclosure grace period shortened from 72h to 24h.** The disclosure/opt-out text
  (ending in `· manage: ruflo settings`, enforced at the content-validation layer) still shows for the
  full window before any promotional content is eligible — just a shorter window now.
- Verified the funnel analytics pipeline: `promo_impression`/`promo_open` events are tracked with a
  pseudonymous, 90-day-rotating ID and daily-bucket timestamps only — no hostname, username, email, or
  path ever leaves the machine. Verified the sponsored-proxy feature remains a fully separate,
  never-bundled opt-in (per `consent.ts`'s "four+ distinct decisions, never bundled" design).
- Confirmed the existing critical-helper auto-refresh mechanism (`autoRefreshHelpersIfStale`) correctly
  propagates the updated `statusline.cjs` to already-initialized projects on their next `ruflo` command
  — no re-`init` required.

## Fixes

- **PR #2622 CI (7 failing checks)** — an npm `overrides`/direct-install conflict in a CI smoke step, 8
  funnel/statusline env vars missing from the CLI-flag-precedence audit's escape-hatch list, a silently
  renamed regression-guard variable, a stdout/stderr contract bug in the shared CLI output formatter
  (warnings/info/debug/trace now correctly go to stderr, matching `printError`), and a help-text
  ordering regression.
- **Security**: fixed a confirmed exponential-backtracking ReDoS (measured: 2.8s at 36 pattern
  repetitions) in the shared npx-hook flag-list regex; stopped inheriting a subprocess's raw stderr in
  the helper/config signing scripts (clear-text-logging hardening); fixed an `EOVERRIDE` conflict where
  `@claude-flow/cli/package.json` declared both `overrides.agentdb` and `optionalDependencies.agentdb`
  for the same package (now uses npm's canonical `$agentdb` self-reference).

## Packages published

`@claude-flow/cli@3.26.0`, `claude-flow@3.26.0`, `ruflo@3.26.0` — `latest`/`alpha`/`v3alpha` dist-tags
all aligned.