v3.41.3

## Security fix

- **Federation event identity**: `fetchRecent`/`fetchManyOn`/`fetchChannel` now apply the signature-verified `id`/`pubkey`/`created_at` *after* the publisher's own message content, instead of before — a publisher could otherwise put those keys in their own content and overwrite their verified identity downstream, which the swarm claims ledger (`reduceClaims`) trusts for release/handoff authorization. Same fix applied to `x_federation_channel_read` in `@claude-flow/cli`, which additionally now verifies event signatures at all (`reqEvents()` previously trusted unverified events). The live `ruflo-x-gateway` production service was redeployed with this fix ahead of this release.
- **Windows hook argument escaping**: `ruflo-hook.cjs`'s Windows `shell:true` npm-shim invocation path now escapes every argument (cmd.exe metacharacter neutralization), so a hook-derived value can no longer be reinterpreted as a separate command or redirection.

See #3322 for the full technical writeup and test coverage.