v3.59.9

## Highlights

- **Security**: removed the unused `toml` dependency (unpatched high-severity CVEs) from `@claude-flow/cli`, root, and `@claude-flow/codex` — `@iarna/toml` was already the actual parser in use, so this was dead-code removal with zero functional change (#4357).
- **ruflo-console**: fixed three related Windows path bugs — the ADR/export/transcript-save project-folder lookup rejected Windows drive-letter and UNC paths (`C:\...`, `\\server\share`) because the guard only checked for a leading `/`. Fixed with a proper cross-platform `isAbsolutePath` check, plus a path-reconstruction fix that no longer mangles a drive/UNC prefix with a bogus leading `/` (#4358, console 0.44.7).
- **Dependency pickup**: `@metaharness/darwin` bumped to `0.12.1`, picking up the upstream contrastive-deadline fix from `ruvnet/metaharness#424` (published as part of this release cycle since the upstream merge hadn't been version-bumped yet) (#4359).

## Notes

- Full test suite showed pre-existing, unrelated intermittent flakiness in this release's worktree (`commands.test.ts` ordering flake — matches tracked #4307; `embeddings-init-skipped-download-3376.test.ts` traced to pnpm workspace-sibling symlink non-determinism for `@claude-flow/embeddings`, unrelated to either merged change). Neither touches `@claude-flow/embeddings`.

## Verification

- `node scripts/audit-leaf-versions-published.mjs` — all 4 non-bundled leaves (cli-core 3.7.5, neural 3.0.0, shared 3.0.5, memory 3.0.8) confirmed published.
- `pnpm -r build` clean across all 24 v3 workspace packages.
- All three packages (`@claude-flow/cli`, `claude-flow`, `ruflo`) confirmed on the live npm registry at 3.59.9, `latest`/`alpha`/`v3alpha` dist-tags updated.

🤖 Generated with [RuFlo](https://github.com/ruvnet/ruflo)