fix: [ENG-2925] address PR #705 review + fix review-handler test

PR #705 review nits:
- Thread CLI `format` through `dispatchCurateHtmlDirect` so the
  `waitForTaskCompletion` stale-check fallback uses the same channel
  as the CLI; no JSON envelope leaking onto stdout in `--format text`.
- Add `projectPath` to the `task:create` payload. Mirrors MCP's
  brv-curate dispatch and removes the worktree-edge-case ambient
  dependency where the CLI's `resolveProjectRoot()` and the daemon's
  workspace-link-aware `resolveProject()` can disagree.
- HTML-decode entities in `curateHtmlDirectRowTitle`'s path-attribute
  fallback (forward-compat — non-issue today, but `foo&bar` would
  otherwise render as `foo&bar` instead of `foo&bar`).
- Mock `requestWithAck` returns `{taskId}` instead of `undefined` so
  the stub matches the `Promise<TaskAck>` contract (bonus fix while
  editing the same hunk).

Test-only:
- `review-handler-reject-restore.test.ts` was calling continueSession
  with the old signature (no `client`) and depended on the in-process
  write. Reworked to replicate the daemon's curate-html-direct
  sequence inline via the shared `backupContextTreeFile` /
  `writeHtmlTopic` / `buildCurateHtmlLogEntry` helpers — same code
  path the daemon runs, so the keying-contract guard the test exists
  to enforce is preserved.

Skipped per review discussion: resource-leak gap on
`requestWithAck` rejection (non-blocking, fix has its own edge cases).