v3.48.0 — stable internal @claude-flow/* packages

Stable internal packages

The internal @claude-flow/* packages are off the alpha line. Everything npx ruflo@3.48.0 installs now resolves to a single stable version:

Package	Version
@claude-flow/cli-core	3.7.0
@claude-flow/memory, neural, shared, security, mcp (and the other internal leaves)	3.0.0
@claude-flow/plugin-agent-federation, plugin-iot-cognitum	1.0.0

@claude-flow/embeddings stays on its alpha line for now.

Also in this release

• Guarded public federation registration (first shipped in 3.47.0 from a release branch) is now on main, so this release keeps it.
• SQL-injection hardening in the @claude-flow/plugins ruvector attention SQL builders. Follow-up for gnn.ts: #3531.
• Smaller, cleaner leaf tarballs. A files allowlist on every leaf stops local runtime state (logs, pids, settings.json) from being packed. The three affected alpha versions are deprecated.

PR: #3530