fix: open protected startup context reviews

[blancmathis]

Summary

• use the owner-resolved startup context settings for list, read, write, and delete API routes
• keep Review Queue discovery and file opening on the same protected scope
• add a regression test for raw project-only narrowing after an owner-authorized global AGENTS.md
• release as context-room 0.6.15

Verification

• npm test: 60/60 test processes passed
• npm audit --audit-level=high: 0 vulnerabilities
• package privacy: 77 files passed
• npm pack --dry-run: context-room@0.6.15
• live Hub browser verification: AGENTS.md opens from Review Queue