v1.15.10

## Summary

- Hardened MCP ambiguous-project recovery so agents can no longer claim `user_selected_after_ambiguous_project` without a recovery token issued by Engram.
- Added short-lived recovery tokens to `ambiguous_project` errors for `mem_save` and `mem_save_prompt`.
- Added regression coverage for missing, invalid, stale, wrong-project, and valid recovery-token flows.

## Details

When project detection is ambiguous, Engram now returns a `recovery_token` and `token_ttl_seconds`. A retry using `project_choice_reason=user_selected_after_ambiguous_project` must include that token, bound to the original ambiguous context and selected project.

This makes accidental or synthetic project-choice claims fail deterministically instead of persisting memory under the wrong project.