v3.59.13

## What's new

- **fix(claims): anchor MCP claims store to project cwd** (#3210) — claims persistence now resolves via `getProjectCwd()` instead of a raw `resolve(CLAUDE_DIR)`, matching every other file-backed MCP tool. A claims-aware MCP server launched in a subdirectory no longer misses `CLAUDE_FLOW_CWD` and silently writes to the wrong store.
- **fix(hooks): resolve globally-installed ruflo before falling back to npx** (#3368, #4368) — `hook-handler.cjs` now checks npm's global prefix, `ruflo`/`claude-flow` on PATH, and `~/.npm-global` before falling back to `npx @claude-flow/cli`. SessionStart refreshes now use the pinned global install instead of a second npx-cached copy that follows the registry's latest.

## Verification

- `audit-umbrella-version-lockstep.mjs` and `audit-leaf-versions-published.mjs`: both clean.
- `claims-project-cwd-3178.test.ts`, `hook-handler-global-cli.test.ts`, `helper-signing.test.ts`: 35/35 passing against the built package.
- Both source PRs went fully green in CI independently before merge.

🤖 Generated with [RuFlo](https://github.com/ruvnet/ruflo)