fix: address PR #663 review feedback

- docs/curate-protocol.md: drop stale BRV_CURATE_TOOL_MODE=1 opt-in
  references (env-var removed in ENG-2815) and scrub TKT ticket numbers
- file-context-file-reader: match `.htm` alongside `.html` to align
  with `getFormatForRead` (prevents silent MD parse on .htm topics)
- query.ts: thread `flags.timeout` into `runRetrieval` via `timeoutMs`
  (was ignored — hardcoded 30s default applied regardless)
- html-writer: extract `escapeHtmlAttributeValue` with full `&<>"`
  escape (ordering matters: `&` first). ISO timestamps pass through
  unchanged; future general-purpose callers no longer at risk
- bv-topic schema: add `.superRefine` rejecting reserved attributes
  (importance, maturity, recency, createdat, updatedat). Defense-in-
  depth at the validation boundary instead of relying solely on the
  writer's regex overlay. Updates the corresponding writer + element
  tests from "writer overrides" to "schema rejects" semantics
- brv-query-tool: simplify `doc.title?.trim()` to `doc.title.trim()`
  to match the non-optional type