v3.59.11

## Highlights

- **appliance**: `ruflo appliance build` failed on every run with `The "paths[0]" argument must be of type string. Received undefined`, and several multi-word flags on `appliance sign` and `appliance update` did nothing (`--generate-keys`, `--key-dir`, `--public-key`, `--no-backup`). The parser stores long flags under camelCase keys and turns `--no-foo` into `foo = false`, but these commands read the raw kebab-case keys, which were never set. Worst of these: `update --public-key` never loaded the key, so patch signature verification never ran. Also fixed `build`'s output reading `result.totalSize` (the real field is `size`), and leaving `models` unset when no `--models` flag is given (so the builder's per-profile default applies) (#4362, same bug class as 3.59.10's daemon/init flag-key fixes).

## Verification

- `node scripts/audit-umbrella-version-lockstep.mjs` — all three packages at 3.59.11, `ruflo` pins `@claude-flow/cli` correctly.
- `node scripts/audit-leaf-versions-published.mjs` — all 4 non-bundled leaves confirmed published.
- `pnpm -r build` clean across all 24 v3 workspace packages.
- New test from #4362 (`appliance-kebab-flags.test.ts`) passes (5/5).
- All three packages (`@claude-flow/cli`, `claude-flow`, `ruflo`) confirmed on the live npm registry at 3.59.11, `latest`/`alpha`/`v3alpha` dist-tags updated.

🤖 Generated with [RuFlo](https://github.com/ruvnet/ruflo)