v3.32.40 — security scan fail-closed on invalid --depth/--type/--target

Fixed

Security (reported privately via SECURITY.md, external reproduction + patch): ruflo security scan validated none of its --depth, --type, or --target flags. An unrecognised value did not error — it silently reduced or eliminated the scan while still printing "No security issues found!" and exiting 0. On a fixture whose only HIGH finding sat below the shallow-traversal budget, --depth full → --depth full (the CLI's own emitted value) silently flipped the critical/high exit-code gate from 1 to 0, and a typo'd --target produced a persisted CLEAN report that downstream status checks trusted as genuine.

All three flags now fail closed before anything is scanned or written:

• --depth/--type validated against exhaustive Record<ScanDepth, number> maps with real type predicates (no unsafe casts that could silently re-disable the recursion limiter)
• --depth full (never a real value, but emitted by the CLI's own statusline/announcements/generated CLAUDE.md/shipped agents) is deprecated-but-accepted → deep, with a warning, rather than breaking every caller told to use it
• --type container (advertised but never implemented) now hard-rejects instead of silently reporting clean — breaking for any pipeline passing it, previously exited 0
• --target validated for existence and directory-ness

246 lines of new tests cover depth-budget boundaries by nesting level, case sensitivity, a path-traversal-via---type attempt, stdout/stderr separation, and no-persisted-report-on-rejection.

PR: #2866

Packages

`@claude-flow/cli`, `claude-flow`, and `ruflo` are all at 3.32.40; `latest`, `alpha`, and `v3alpha` dist-tags all point to it.