v3.32.33

# Ruflo v3.32.33: Autopilot Scope Enforcement at the Real CLI Boundary

v3.32.33 completes the Flywheel and Autopilot reliability release by enforcing
explicit task-source validation through the same normalized flags users pass
to the CLI.

The V3 parser converts kebab-case options such as `--task-sources` and
`--max-iterations` to `taskSources` and `maxIterations`. The initial validation
implementation correctly rejected unsupported values at the service and MCP
layers but read the legacy kebab-case keys in the CLI action. As a result, the
real command ignored the supplied value and persisted the default source set.

This release reads the parser's canonical camelCase keys while retaining the
legacy keys for direct action callers. A parser-to-command integration test and
an immutable-tarball release smoke now prove that unsupported task sources fail
without creating state.

## Install or upgrade

```bash
npm install --global ruflo@3.32.33
ruflo doctor
```

## Configure an exact Autopilot scope

```bash
ruflo autopilot config \
  --task-sources swarm-tasks,file-checklist \
  --max-iterations 77
```

Unsupported sources fail and leave the stored configuration unchanged:

```bash
ruflo autopilot config --task-sources issues
```

## Flywheel fix included

The release also includes the v2 retrieval safety envelope from #2836. The
built-in proposer can evaluate bounded full-policy candidates without gaining
promotion authority.

```bash
ruflo metaharness flywheel status
ruflo metaharness flywheel run --proposer local
```

## Release lineage

- `v3.32.31` stopped before npm publication because its helper manifest was
  signed for the prior version.
- `v3.32.32` corrected the signed manifest and was published, but independent
  post-registry validation found the CLI flag-normalization mismatch.
- `v3.32.33` is the validated release and receives the stable npm tags.