v3.38.5

## Fixes

**#2911 — `ruflo-adr`'s ADR importer indexed thousands of foreign ADRs from ruvnet-brain's cloned repos, burying the project's own.** `SKIP_DIRS` omitted `.brain`, which holds shallow clones of ~50 external repos, many with their own `docs/adr/`. Since `.brain` sorts before `docs`, the project's own ADRs landed dead last in the walk order — an interrupted run could index hundreds of foreign ADRs and zero of the project's own. Added `.brain` to `SKIP_DIRS`. Also fixed the plugin's own smoke test, which hard-coded its regression-test-file count and broke on the new test file this fix added.

**#2963 — `github_issue_track`'s `create`/`update`/`close`/`list` actions validated the caller-supplied `owner`/`repo` but never passed them to `gh`.** `gh` silently resolved the target repository from the current working directory's git remote instead — a caller supplying `owner`/`repo` expecting an operation to land in that specific repository had no guarantee it did. Now passes `--repo <owner>/<repo>` to `gh` whenever both are supplied.

**#2931 — `security scan`'s hardcoded-secret detection missed common real-world Stripe/OpenAI key shapes.** The regex required 20+ characters after the `sk-`/`sk_live_`/`sk_test_` prefix (missing shorter-but-real keys) and a quote literally adjacent to the prefix (missing the very common `Authorization: "Bearer sk_live_..."` shape, where the quote sits next to "Bearer", not the key). Replaced with lookaround word-boundaries and a lower length floor.

## Links

- PR: [#2994](https://github.com/ruvnet/ruflo/pull/2994)
- PR: [#2995](https://github.com/ruvnet/ruflo/pull/2995)
- PR: [#2996](https://github.com/ruvnet/ruflo/pull/2996)
- Previous release: [v3.38.4](https://github.com/ruvnet/ruflo/releases/tag/v3.38.4)