v3.59.7 — policy lock hardening + session_list total fix

Fixes

• Policy lock fails fast on path errors instead of timing out (#4343). acquireLock() treated
  every openSync() error as lock contention, so a permission error, missing parent directory, or
  a directory/symlink/FIFO planted at the lock path waited the full 5s lock budget on every MCP
  tool call before surfacing a misleading policy-state-lock-timeout. The lock is now created
  with O_NOFOLLOW (where supported) to close the create-through-a-symlink path; non-contention
  errors now surface immediately, and a non-regular file planted at the lock path is rejected
  rather than treated as a reclaimable lock.
• session_list now reports every saved session in total, not just the returned page (#4344).
  ruflo session list previously printed e.g. "Showing 10 of 10 sessions" even when 30 sessions
  were saved, since total was computed after the limit was applied. Same pattern already
  fixed for task_list in #4324.

Published

• @claude-flow/cli@3.59.7, claude-flow@3.59.7, ruflo@3.59.7 — latest/alpha/v3alpha
  dist-tags all verified matching on the live registry.