ruflo init 3.38.21 ignores --no-codex-detect and --no-skills-sh

## Summary

Published `ruflo@3.38.21` registers `--no-codex-detect` and `--no-skills-sh`, but a fresh
`ruflo init` does not honor either CLI flag. On a machine with Codex on `PATH`, the supposedly
suppressed Codex initializer writes six project skills and the skills.sh guard writes a seventh
`ruflo` skill.

This is distinct from the broader init/plugin duplication tracked in #2640: the explicit
documented opt-outs themselves do not work.

## Minimal reproduction

Environment:

- macOS arm64
- Node `v26.4.0`
- `ruflo v3.38.21`
- nested `@claude-flow/cli@3.38.21`
- Codex CLI present on `PATH`

From an empty temporary directory:

```text
ruflo init --full --force --no-global --no-codex-detect --no-skills-sh --no-signup
```

Observed output includes both:

```text
OpenAI Codex detected — configured
.agents/skills/: 6 skills
Registering the core `ruflo` skill for cross-agent discovery
```

Observed filesystem:

```text
.agents/skills/github-automation/SKILL.md
.agents/skills/memory-management/SKILL.md
.agents/skills/performance-analysis/SKILL.md
.agents/skills/ruflo/SKILL.md
.agents/skills/security-audit/SKILL.md
.agents/skills/sparc-methodology/SKILL.md
.agents/skills/swarm-orchestration/SKILL.md
```

Count: 7.

## Expected

- `--no-codex-detect` prevents auto-detected Codex configuration, including `AGENTS.md`,
`.agents/config.toml`, and `.agents/skills`.
- `--no-skills-sh` prevents materialization of `.agents/skills/ruflo/SKILL.md`.
- Neither suppressed surface appears in output or on disk.

## Source evidence

The installed init handler checks:

```js
ctx.flags['no-codex-detect'] === true
ctx.flags['no-skills-sh'] === true
```

Both options are registered as hyphenated boolean names in the same compiled file. The observed
behavior is consistent with the parser normalizing those keys while these guards read the literal
hyphenated form.

Artifact SHA-256:

```text
ruflo/bin/ruflo.js
af863233c65b825ae38c689f759d9dcbb18528b42771aed4e929ca6d57f21ccd

ruflo/node_modules/@claude-flow/cli/dist/src/commands/init.js
76edf28c67b0cb03b3a0b3cd9387e3660250e8fea4247f79d6c59b8990d9cb1c
```

## Bounded downstream containment

Agentic-kit invokes Ruflo for Claude project/runtime assets while owning Codex host selection.
Until a released Ruflo build proves these flags, it will additionally set
`RUFLO_NO_SKILLS_SH=1` and use scripted `--format json` mode; the installed handler independently
skips both optional projections in that mode. It will not delete unreceipted existing skills.

## Acceptance criteria

1. Add command-level tests that pass each opt-out independently and together.
2. Assert the suppressed files/directories are absent, not merely omitted from a summary.
3. Exercise the `ruflo` wrapper path, not only an internal handler unit.
4. Keep the flags working with `--full`, `--force`, `--no-global`, and noninteractive execution.
5. Re-running the same command remains byte-idempotent and creates no suppressed artifacts.

Reproduce the wrapper command with --full, --force, --no-global, both opt-outs, and --no-signup, then inspect ruflo/bin/ruflo.js and node_modules/@claude-flow/cli/dist/src/commands/init.js, including their flag parsing and init handler entry points. Add command-level coverage for each flag independently and together, asserting suppressed paths are absent and repeated runs are byte-idempotent.

Written by the indexing model from the issue text.