v3.49.0

## ruflo 3.49.0

Install: `npx ruflo@latest` (also `@claude-flow/cli@3.49.0`, `claude-flow@3.49.0`). `@claude-flow/security@3.0.1` is bundled and published standalone.

This release fixes eleven issues reported by **Martin Vladimirov (@martinvlad)**. Each report included measurements and a reproduction, and that is what made fixing them quick. It also includes two PRs from **Nick Ruest (@nicholas-ruest)** and one from **@drakeo338**.

### Fixes
- **#3555: helpers load in `"type":"module"` projects.** `router`, `session` and `memory` now ship as `.cjs`, so ESM projects no longer get "Router not available" (#3583).
- **#3565: post-install helper tampering is detected and healed.** An integrity re-check runs even when the version stamp matches, contributed by Nick Ruest (#3576). `doctor` now reports it as well (#3583).
- **#3567: `hooks_route` no longer reports high confidence on no match.** It used to report 70% when nothing matched; it now returns 30% with `matched:false` / `no-match-default`. Whitespace-only tasks are rejected (#3581).
- **#3568: policy ledger truncation is now detectable.** The ledger records its head anchor and length; this change is in `@claude-flow/security` 3.0.1 (#3579).
- **#3557: plugin install trust policy.** Install scripts are gated (#3580).
- **#3556: ai-team discovery uses a CORS allowlist.** 0.1.6 is live on team.ruv.io (#3577).
- **#3566: sibling-namespace disclosure.** Partial matches are disclosed, and import reports real vector counts (#3582).
- **#3570: memory key and namespace validation.** One shared validator covers the CLI and MCP; contributed by @drakeo338 (#3571).
- **#3572: `swarm status` progress.** It reports `null` instead of invented numbers (#3578).
- **#3573, #3575: session import and memory fixes** (#3584).
- **doctor native-driver detection.** The better-sqlite3 loader is now injectable; contributed by Nick Ruest (#3569).

### Verified on the published packages
Fresh `npm i ruflo@3.49.0` in a `"type":"module"` project: helpers install as `.cjs` and routing works; no-match routes report 30%; `swarm status` progress is `null`; a tampered `router.cjs` is detected and restored. Witness manifests verify 117/117 on linux, macos and windows, and the signed helper manifest verifies.

Thanks to Martin, Nick and drakeo338.

Gist: https://gist.github.com/ruvnet/75fea5568fc33a4ba55c04104a28a779