v3.56.3

Patch release: AgentDB `3.0.0-alpha.20` update. `@claude-flow/memory` **3.0.3** (published standalone; the CLI pins it exactly) and `@claude-flow/cli` / `claude-flow` / `ruflo` **3.56.3**. `neural`, `shared`, `cli-core` unchanged.

### Changed
- AgentDB floor `^3.0.0-alpha.17` -> `^3.0.0-alpha.20` (memory, cli, root, ruflo). alpha.20 swaps `@xenova/transformers` for `@huggingface/transformers`, `@ruvector/rvf` 0.1.9 -> 0.2.3, `ruvector` -> 0.2.x.
- Search scores shift slightly (same-text cosine ~0.992 vs alpha.17): an entry that scored just under the 0.3 default threshold can now appear just above it, ranked far below the exact-keyword hit. One regression-test assertion was adjusted for this (PR #3960).

### Fixed
- sql.js stale `<db>.agentdb.lock`: AgentDB alpha.20 refuses saves while the lock exists, and a lock left by a crashed writer was never cleared, so every later save failed and the db file was never created. `@claude-flow/memory` now clears the lock only when provably stale (regular file named exactly `<db>.agentdb.lock`, numeric dead PID, >10 s old, atomic rename-aside + re-verify), retries once, otherwise throws `AgentdbLockError`. A failed persist on shutdown is now surfaced (`ControllerRegistry`, `AgentDBBackend`, `HybridBackend`, `shutdownBridge`) instead of swallowed. Affects only the sql.js path (no native better-sqlite3).
- Dev tree only: `pnpm.packageExtensions` declares `onnxruntime-common` for `@huggingface/transformers@4.2.0`.

### Known / not verified
- agentdb 3.0.0-alpha.20 has no npm provenance attestation (registry signature present).
- Under pnpm 4.2.0 the embedder fell back to mock embeddings before the extension above; npm installs resolve transformers 4.3.1 and were unaffected.
- AgentDB `forceWasm: true` still selects better-sqlite3 unless `AGENTDB_FORCE_SQLJS=1` (upstream behaviour).

PR #3960.