fix(context): read only the selected project body in project briefs

[filocosta46]

What this does

A valid project brief now succeeds when another project's README exceeds 1 MiB. Project-scoped context reads inspect bounded sibling frontmatter for identity checks, then open only the selected project's body.

Catalog identity collisions and changes during the read still fail closed. Frontmatter is limited to 16 KiB; a truncated closing delimiter is accepted only when the file snapshot proves actual EOF. The selected README retains its existing 1 MiB limit.

What this does not do

Shared and Off projections, native project routing, and release behavior are unchanged.

How you checked

• npm test — 2,662 passed, 9 skipped, zero failures.
• npm run smoke — passed.

Checks ran against a clean snapshot with the identical Git tree committed here. Regression coverage verifies sibling body bytes stay unread, selected-file and metadata bounds hold, identity collisions and catalog changes are rejected, and core, CLI, hook, and MCP output agree without writing to the fixture.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Team

Run ID: a8d9bfd8-9583-49ab-b989-ed8da6b6b1cf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[filocosta46]

Superseded by #150.

That branch carries this work reconciled with the other two context-admission PRs, and #150's head is green on all 8 checks. Verified equivalence before closing: #150 retains 18/18 of #146's added tests, 6/6 of #147's, and 9/9 of #148's (one renamed). #146's head here never received the project-root-swap repair; #150 contains it, byte-identical to the reviewed local fix.

This head is older than #150 and conflicts with it, so merging it would regress. Closing rather than merging. The branch is archived in a local git bundle and this PR can be reopened if #150 is ever abandoned.