v3.59.8

## Fixes

- `memory_delete` / `purgeNamespace` now scrub the tombstone row's payload (#4351). Soft-deleted
  entries previously left `content`, `embedding`, `tags`, and `metadata` intact on disk with only
  `status` flipped to `'deleted'` — recoverable from the raw file image. The tombstone UPDATE now
  clears all of those fields, and both the sql.js and native delete paths enable
  `PRAGMA secure_delete = ON` before deleting so freed SQLite pages don't retain the old bytes
  either.
- `config_list` now correctly merges non-default scopes into the default view (#4354). The
  scope-merge loop treated `scope === 'default'` identically to an exact scope-name match, which
  made the `else if (!merged.has(key))` branch — already documented as the intended "merge other
  scopes in without overwriting" behavior — unreachable for the default case. A value set only at
  a non-default scope was silently dropped from the default-scope listing.

## Published

- `@claude-flow/cli@3.59.8`, `claude-flow@3.59.8`, `ruflo@3.59.8` — `latest`/`alpha`/`v3alpha`
  dist-tags all verified matching on the live registry.