v3.32.16

Completes the dream-cycle #2783 ADR-320 recommendation: Composition Inspector (v3.32.15) + ChannelGuard (this release).

## Added

**`ruflo security channel-scan`** — deterministic (no LLM) inter-agent message scanner. arXiv 2607.19430: individually-safe LLM agents propagate injection payloads through inter-agent message channels; per-message safety checks pass at each hop. ChannelGuard closes the gap by scanning content at the routing boundary.

Four attack signatures:

1. **Injection-phrase** — shared 16-phrase catalog with composition-scan (new `src/security/injection-catalog.ts`; a phrase added there strengthens both surfaces).
2. **Role-shift** — `system:` / `assistant:` / `user:` markers appearing INSIDE the message body (start-of-message preambles allowed).
3. **Encoded-payload** — long base64/hex runs that could hide obfuscated instructions.
4. **Zero-width/bidi unicode** — U+200B, U+200C, U+200D, U+FEFF, U+202A-E, U+2066-9 — zero legitimate use in agent messages.

Usage:
```
ruflo security channel-scan -m "…message text…"
ruflo security channel-scan --message-file ./inbox/msg-1234.txt
```

Exit codes: 0 safe, 2 flagged — shell-integration friendly (`channel-scan && forward` skips flagged messages).

## Verification

- Regression tests: **9/9** for ChannelGuard, 6/6 for Composition Inspector, **15/15 total**.
- E2E on malicious message → 5 findings across 3 signature categories.
- E2E on benign handoff → SAFE, 0 findings.

## Upgrade

```bash
npx ruflo@latest --version   # → 3.32.16
```

Refs: dream-cycle #2783.